CyberSIXT Search
Vendor

SAP

CVEs tracked · all time
25
in CISA KEV · all time
2
articles · since 11 Sep
4
articles · all time
25

4 articles since 11 Sep.

Show as table
SAP: articles per day
Day (UTC)Articles
Fri 18 Sep1
Tue 13 Oct2
Wed 14 Oct1
See the full timeline
Products: Commerce Cloud, NetWeaver, SAP Approuter, SAP Business Planning and Consolidation and SAP Business Warehouse and 17 more
Commerce CloudNetWeaverSAP ApprouterSAP Business Planning and Consolidation and SAP Business WarehouseSAP CloudSAP Cloud Application Programming Model (CAP)SAP Commerce CloudSAP Commerce Cloud (Data Hub Adapter)SAP Commerce cloud configurationSAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)SAP Extended Passport (EPP) ProcessingSAP Forecasting & ReplenishmentSAP Manufacturing Integration and Intelligence (Configuration Service)SAP NetWeaver (Message Server)SAP NetWeaver (SAP GUI for Java)SAP NetWeaver Application Server ABAPSAP NetWeaver Application Server Java (Web Container)SAP NetWeaver AS ABAP and ABAP PlatformSAP NetWeaver Visual ComposerSAP S/4HANA (Manage Substitution/Validation Rules)SAP S/4HANA (SAP Enterprise Search for ABAP)

CVEs

25 CVEs
CVE-2019-0344SAP Commerce Cloud Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited7.1%EPSS1article
CVE-2025-31324SAP NetWeaver Unrestricted File Upload VulnerabilityCVSS10.0CriticalExploited99.4%EPSS1article
CVE-2026-89111OAuth2 SSRF vulnerability in SAP Cloud SDK for PythonCVSS10.0Critical–Not in KEV0.3%EPSS3articles
CVE-2026-89107Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)CVSS9.9Critical–Not in KEV0.4%EPSS1article
CVE-2026-89110Broken Access Control in SAP NetWeaver Visual ComposerCVSS9.9Critical–Not in KEV0.3%EPSS2articles
CVE-2026-89108Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)CVSS9.1Critical–Not in KEV0.3%EPSS1article
CVE-2026-89113SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)CVSS8.8High–Not in KEV0.3%EPSS1article
CVE-2026-89120Missing authorization check in SAP ABAP PlatformCVSS7.1High–Not in KEV0.2%EPSS0articles
CVE-2026-44756Memory Corruption vulnerability in SAP Extended Passport (EPP) ProcessingCVSS10.0Critical–Not in KEV1.4%EPSS5articles
CVE-2026-58240Missing Authentication check in SAP NetWeaver (Message Server)CVSS9.8Critical–Not in KEV0.5%EPSS3articles
CVE-2026-76969Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)CVSS9.4Critical–Not in KEV0.4%EPSS3articles
CVE-2026-66768Improper Access Control in SAP NetWeaver (SAP GUI for Java)CVSS9.0Critical–Not in KEV0.6%EPSS2articles
13 more CVEs
CVE-2026-58231Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)CVSS10.0Critical–Not in KEV0.9%EPSS5articles
CVE-2026-44747Memory Corruption vulnerability in SAP NetWeaver Application Server ABAPCVSS9.9Critical–Not in KEV0.6%EPSS2articles
CVE-2026-44761Insecure Sample Credentials in SAP Commerce CloudCVSS9.1Critical–Not in KEV0.5%EPSS2articles
CVE-2026-27690HTTP Request Smuggling in SAP ApprouterCVSS9.1Critical–Not in KEV0.7%EPSS2articles
CVE-2026-44748XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP PlatformCVSS9.9Critical–Not in KEV0.3%EPSS2articles
CVE-2026-27671Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP PlatformCVSS9.8Critical–Not in KEV0.6%EPSS0articles
CVE-2026-40128SAP_SE SAP NetWeaver Application Server Java (Web Container) vulnerabilityCVSS9.0Critical–Not in KEV0.6%EPSS2articles
CVE-2026-34260SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)CVSS9.6Critical–Not in KEV0.4%EPSS1article
CVE-2026-34263SAP_SE SAP Commerce cloud configuration vulnerabilityCVSS9.6Critical–Not in KEV0.6%EPSS2articles
CVE-2026-34259SAP_SE SAP Forecasting & Replenishment vulnerabilityCVSS8.2High–Not in KEV0.2%EPSS1article
CVE-2026-27681SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business WarehouseCVSS9.9Critical–Not in KEV0.6%EPSS2articles
CVE-2026-34256SAP_SE SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) vulnerabilityCVSS7.1High–Not in KEV0.3%EPSS1article
CVE-2026-0488Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)CVSSUnrated–Not in KEV0.5%EPSS3articles

Coverage

25 articles, all timeFull timeline RSS feed
  1. SAP Patches Critical Flaws That Could Enable NetWeaver System TakeoverSecurityWeek
  2. Critical SAP Python SDK flaw could expose OAuth credentials via SSRFThe Hacker News
  3. SAP Patches Critical Cloud SDK Flaw That Could Expose CredentialsSecurityOnline
  4. Ukrainian Ransomware Developer Gets 13 Years Over $123m AttacksSecurityWeek
  5. SAP Patches Critical SAP Flaws Enabling Unauthenticated RCEThe Hacker News
  6. Over 10,000 SAP Systems Exposed to Critical Kernel FlawInfosecurity
  7. SAP Fixes Critical EPP Flaw Allowing Full System CompromiseSecurityWeek
  8. SAP Patches Critical EPP Flaw Exposing Systems to Memory CorruptionSecurityOnline
  9. SAP Commerce Cloud flaw lets attackers run code after patch delaySecurityWeek
  10. Hackers Leverage Expired Domains for Malware, SAP, macOS ExploitsSecurity Affairs
  11. SAP Commerce Cloud CVE-2026-58231 Exploited in the WildSecurity Affairs
  12. SAP patches critical CVE-2026-58231 in Commerce Cloud, 28 notesSecurityOnline
  13. SAP Patches Critical Code Injection, Memory Corruption VulnerabilitiesSecurityWeek
  14. SAP patches memory corruption flaw in NetWeaver after Patch DaySecurityWeek
  15. SAP July 2026 Patch Tackles NetWeaver Memory Corruption BugSecurityOnline
  16. SAP issues urgent patch for critical SAML flaw CVE-2026-44748SecurityWeek
  17. SAP SAML bug lets attackers bypass login, urgent patch called forSecurityOnline
  18. Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation FlawsThe Hacker News
  19. SAP Patches Critical S/4HANA, Commerce VulnerabilitiesSecurityWeek
  20. Exploiters target SAP SQLi and Adobe zero day flaws in AprilThe Hacker News
  21. SAP fixes critical SQLi in BW/BPC after April 2026 patch daySecurityWeek
  22. M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 SecondsSecurityWeek
  23. Over 60 Software Vendors Issue Security Fixes Across OS, Cloud, and Network PlatformsThe Hacker News
  24. SAP Patches Critical CRM, S/4HANA, NetWeaver VulnerabilitiesSecurityWeek
  25. Critical SAP Alert: Code Injection (CVSS 9.9) Exposes S/4HANA DatabasesSecurityOnline · first in our coverage

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device