Vendor

SAP

14 of 28 SAP CVEs in Patchfirst (50%) are in of vulnerabilities exploited in the wild, 3 of them used by ransomware.

CVEs: 28
In CISA KEV: 1450%
Known ransomware use: 3
Median days to KEV: 1,574; from publication
Latest KEV listing: 15 May 2025

Watch SAP Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
NetWeaver In KEV: 10 CVEs: 10
Commerce Cloud In KEV: 1 CVEs: 1
Customer Relationship Management (CRM) In KEV: 1 CVEs: 1
Multiple Products In KEV: 1 CVEs: 1
Solution Manager In KEV: 1 CVEs: 1
SAP BusinessObjects Business Intelligence Platform In KEV: 0 CVEs: 1
SAP BusinessObjects Business Intelligence Platform (Web Services) In KEV: 0 CVEs: 1
SAP Cloud In KEV: 0 CVEs: 1
SAP Commerce Cloud (Data Hub Adapter) In KEV: 0 CVEs: 1
SAP Internet Graphics Server In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with SAP CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 12
T1059Command and Scripting Interpreter CVEs: 6
T1005Data from Local System CVEs: 4
T1078Valid Accounts CVEs: 3
T1505.003Web Shell CVEs: 2

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/sap.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are SAP CVEs linked to the technique. Each link’s provenance is on the CVE page.

SAP CVEs

28 CVEs, by priority

CVE-2025-31324SAP NetWeaver Unrestricted File Upload Vulnerability
SAP · NetWeaverKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting Interpreter T1505.003Web Shell+2 more · 1 report
99.5%Top 0.06%
83.7priority
CVE-2025-42999SAP NetWeaver Deserialization Vulnerability
SAP · NetWeaverKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter+1 more
12.9%Top 3.7%
78.6priority
CVE-2018-2380SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
SAP · Customer Relationship Management (CRM)KEVRansomwarePublic exploitMedium · 6.6T1190Exploit Public-Facing Application T1005Data from Local System
28.9%Top 1.8%
77.3priority
CVE-2026-58231Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
SAP_SE · SAP Commerce Cloud (Data Hub Adapter)Public exploitCritical · 10.0
0.9%Top 42%
71.5priority
CVE-2022-22536SAP Multiple Products HTTP Request Smuggling Vulnerability
SAP · Multiple ProductsKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1557Adversary-in-the-Middle
97.9%Top 0.09%
70.0priority
CVE-2020-6287SAP NetWeaver Missing Authentication for Critical Function Vulnerability
SAP · NetWeaverKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1078Valid Accounts
94.7%Top 0.14%
70.0priority
CVE-2020-6207SAP Solution Manager Missing Authentication for Critical Function Vulnerability
SAP · Solution ManagerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1078Valid Accounts
98.1%Top 0.09%
69.8priority
CVE-2016-2386SAP NetWeaver SQL Injection Vulnerability
SAP · NetWeaverKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
71.5%Top 0.58%
69.7priority
CVE-2020-6286The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM…
SAP SE · SAP NetWeaver AS JAVA (LM Configuration Wizard)Public exploitMedium · 5.3
23.7%Top 2.2%
69.0priority
CVE-2021-38163SAP NetWeaver Unrestricted File Upload Vulnerability
SAP · NetWeaverKEVPublic exploitHigh · 8.8T1078Valid Accounts T1059Command and Scripting Interpreter
36.9%Top 1.5%
68.9priority
CVE-2017-12637SAP NetWeaver Directory Traversal Vulnerability
SAP · NetWeaverKEVPublic exploitHigh · 7.5T1592Gather Victim Host Information T1190Exploit Public-Facing Application+2 more
95.1%Top 0.14%
68.2priority
CVE-2016-3976SAP NetWeaver Directory Traversal Vulnerability
SAP · NetWeaverKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing Application T1005Data from Local System
47.3%Top 1.2%
68.0priority
CVE-2021-33690Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure…
SAP SE · SAP NetWeaver Development Infrastructure (Component Build Service)Public exploitCritical · 9.9
69.1%Top 0.65%
67.5priority
CVE-2016-2388SAP NetWeaver Information Disclosure Vulnerability
SAP · NetWeaverKEVPublic exploitMedium · 5.3T1190Exploit Public-Facing Application T1005Data from Local System
52.2%Top 1%
66.5priority
CVE-2021-21479In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the…
SAP SE · SCIMonoPublic exploitHigh · 8.1
10.1%Top 4.4%
64.8priority
CVE-2010-5326SAP NetWeaver Remote Code Execution Vulnerability
SAP · NetWeaverKEVCritical · 10.0T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
17.8%Top 2.8%
64.4priority
CVE-2020-26836SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading…
SAP SE · SAP Solution Manager (Trace Analysis)Public exploitLow · 3.4
2.2%Top 18%
63.9priority
CVE-2025-42957Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
SAP_SE · SAP S/4HANA (Private Cloud or On-Premise)Public exploitCritical · 9.9
1.6%Top 24%
63.8priority
CVE-2019-0344SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
SAP · Commerce CloudKEVCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter
7.5%Top 5.5%
63.8priority
CVE-2020-6308SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated…
SAP SE · SAP BusinessObjects Business Intelligence Platform (Web Services)Public exploitMedium · 5.3
61.7%Top 0.83%
63.5priority
CVE-2016-9563SAP NetWeaver XML External Entity (XXE) Vulnerability
SAP · NetWeaverKEVMedium · 6.5T1190Exploit Public-Facing Application T1005Data from Local System
24.2%Top 2.1%
62.1priority
CVE-2018-2392Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML…
SAP SE · SAP Internet Graphics ServerPublic exploit
41.1%Top 1.3%
59.7priority
CVE-2021-42063A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50
SAP SE · SAP Knowledge WarehousePublic exploit
23.4%Top 2.2%
59.6priority
CVE-2024-41730Missing Authentication check in SAP BusinessObjects Business Intelligence Platform
SAP_SE · SAP BusinessObjects Business Intelligence PlatformCritical · 9.8
75.9%Top 0.47%
28.1priority
CVE-2026-89107SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition…
SAP_SE · SAP S/4HANA (Manage Substitution/Validation Rules)Critical · 9.9
0.5%Top 59%
17.4priority
CVE-2026-89110SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality
SAP_SE · SAP NetWeaver Visual ComposerCritical · 9.9
0.4%Top 66%
16.0priority
CVE-2026-89111The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications
SAP_SE · SAP CloudCritical · 10.0
0.4%Top 69%
15.4priority
CVE-2026-89108SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain…
SAP_SE · SAP Manufacturing Integration and Intelligence (Configuration Service)Critical · 9.1
0.4%Top 67%
15.1priority