Vulnerabilities by vendor · updated on every deploy
SAP vulnerabilities: exploited CVEs and our analysis
SAP has 14 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 0 of them added in the last 12 months and 3 known to be used in ransomware campaigns. Below: the analysis Zero Hunt Research published on SAP products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
14
CVEs in CISA KEV
0
Added in the last 12 months
3
Known ransomware use
1
Zero Hunt analyses
Products with the most KEV entries: NetWeaver (10) · Commerce Cloud (1) · Customer Relationship Management (CRM) (1) · Multiple Products (1) · Solution Manager (1)
Our analysis of SAP vulnerabilities
2026-09-10
CVE-2026-44756 (SAP OVERPASS): CVSS 10 Pre-Auth Kernel RCE, Patch and HuntingCVE-2026-44756 OVERPASS is a CVSS 10 pre-auth RCE in the SAP kernel over HTTP, SAP GUI and RFC. What to patch, how to hunt it, how to see it on the wire.
All 14 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2025-05-15 | CVE-2025-42999 | NetWeaver SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deseriali… | 2025-06-05 | Ransomware | — |
| 2025-04-29 | CVE-2025-31324 | NetWeaver SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries. | 2025-05-20 | Ransomware | — |
| 2025-03-19 | CVE-2017-12637 | NetWeaver SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) i… | 2025-04-09 | — | |
| 2024-09-30 | CVE-2019-0344 | Commerce Cloud SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection. | 2024-10-21 | — | |
| 2022-08-18 | CVE-2022-22536 | Multiple Products SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's r… | 2022-09-08 | — | |
| 2022-06-09 | CVE-2021-38163 | NetWeaver SAP NetWeaver contains a vulnerability that allows unrestricted file upload. | 2022-06-30 | — | |
| 2022-06-09 | CVE-2016-2388 | NetWeaver The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. | 2022-06-30 | — | |
| 2022-06-09 | CVE-2016-2386 | NetWeaver SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | 2022-06-30 | — | |
| 2021-11-03 | CVE-2020-6287 | NetWeaver SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users. | 2022-05-03 | — | |
| 2021-11-03 | CVE-2020-6207 | Solution Manager SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager. | 2022-05-03 | — | |
| 2021-11-03 | CVE-2018-2380 | Customer Relationship Management (CRM) SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users. | 2022-05-03 | Ransomware | — |
| 2021-11-03 | CVE-2016-9563 | NetWeaver SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks. | 2022-05-03 | — | |
| 2021-11-03 | CVE-2016-3976 | NetWeaver SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read fi… | 2022-05-03 | — | |
| 2021-11-03 | CVE-2010-5326 | NetWeaver SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request. | 2022-05-03 | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many SAP vulnerabilities are in the CISA KEV catalog?
14 in catalog version 2026.10.21, the first added on 2021-11-03 and the most recent on 2025-05-15. 0 were added in the last 12 months.
Which SAP products have the most exploited vulnerabilities?
By KEV entries: NetWeaver (10), Commerce Cloud (1), Customer Relationship Management (CRM) (1), Multiple Products (1), Solution Manager (1).
Are SAP vulnerabilities used in ransomware attacks?
CISA marks 3 of the 14 SAP entries as known to be used in ransomware campaigns. The table flags them.
Is the next SAP CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · Atlassian · Zyxel · Progress · F5