SAP known exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists 14 SAP vulnerabilities: 0 added in the last 365 days, 9 rated critical (CVSS 9 or higher), and 3 with known ransomware use. The most recent was added May 15, 2025.
RSS feed for SAP exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant
| Added to KEV | CVE | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|
| 2025-05-15 | CVE-2025-42999 | SAP NetWeaver Deserialization Vulnerability | 9.1 (v3.1) | 12.9% | 2025-06-05 | Known |
| 2025-04-29 | CVE-2025-31324 | SAP NetWeaver Visual Composer malicious file upload | 10 (v3.1) | 99.5% | 2025-05-20 | Known |
| 2025-03-19 | CVE-2017-12637 | SAP NetWeaver Directory Traversal Vulnerability | 7.5 (v3.1) | 95.1% | 2025-04-09 | Unknown |
| 2024-09-30 | CVE-2019-0344 | SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | 9.8 (v3.1) | 7.5% | 2024-10-21 | Unknown |
| 2022-08-18 | CVE-2022-22536 | SAP Multiple Products HTTP Request Smuggling Vulnerability | 10 (v3.1) | 97.9% | 2022-09-08 | Unknown |
| 2022-06-09 | CVE-2016-2386 | SAP NetWeaver SQL Injection Vulnerability | 9.8 (v3.1) | 71.5% | 2022-06-30 | Unknown |
| 2022-06-09 | CVE-2016-2388 | SAP NetWeaver Information Disclosure Vulnerability | 5.3 (v3.1) | 52.2% | 2022-06-30 | Unknown |
| 2022-06-09 | CVE-2021-38163 | SAP NetWeaver Unrestricted File Upload Vulnerability | 9.9 (v3.1) | 36.9% | 2022-06-30 | Unknown |
| 2021-11-03 | CVE-2010-5326 | SAP NetWeaver Remote Code Execution Vulnerability | 10 (v3.1) | 17.8% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2016-3976 | SAP NetWeaver Directory Traversal Vulnerability | 7.5 (v3.1) | 47.3% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2016-9563 | SAP NetWeaver XML External Entity (XXE) Vulnerability | 6.5 (v3.1) | 24.2% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2018-2380 | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability | 6.6 (v3.1) | 28.9% | 2022-05-03 | Known |
| 2021-11-03 | CVE-2020-6207 | SAP Solution Manager Missing Authentication for Critical Function Vulnerability | 10 (v3.0) | 98.1% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2020-6287 | SAP NetWeaver Missing Authentication for Critical Function Vulnerability | 10 (v3.0) | 94.7% | 2022-05-03 | Unknown |