{"meta":{"title":"KEV entries: SAP","description":"All KEV entries for vendor SAP.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":14,"vendor":"SAP","entries":14,"shareOfCatalogPercent":0.8,"ransomwareKnown":3,"firstDateAdded":"2021-11-03","latestDateAdded":"2025-05-15","rank":19},"data":[{"cveID":"CVE-2025-42999","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Deserialization Vulnerability","dateAdded":"2025-05-15","dueDate":"2025-06-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3604119 ; https://nvd.nist.gov/vuln/detail/CVE-2025-42999","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-42999"},{"cveID":"CVE-2025-31324","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Unrestricted File Upload Vulnerability","dateAdded":"2025-04-29","dueDate":"2025-05-20","knownRansomwareCampaignUse":"Known","cwes":["CWE-434"],"shortDescription":"SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://me.sap.com/notes/3594142 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31324","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-31324"},{"cveID":"CVE-2017-12637","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Directory Traversal Vulnerability","dateAdded":"2025-03-19","dueDate":"2025-04-09","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3476549 ; https://nvd.nist.gov/vuln/detail/CVE-2017-12637","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2017-12637"},{"cveID":"CVE-2019-0344","vendorProject":"SAP","product":"Commerce Cloud","vulnerabilityName":"SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability","dateAdded":"2024-09-30","dueDate":"2024-10-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://web.archive.org/web/20191214053020/https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 ; https://nvd.nist.gov/vuln/detail/CVE-2019-0344","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2019-0344"},{"cveID":"CVE-2022-22536","vendorProject":"SAP","product":"Multiple Products","vulnerabilityName":"SAP Multiple Products HTTP Request Smuggling Vulnerability","dateAdded":"2022-08-18","dueDate":"2022-09-08","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-444"],"shortDescription":"SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.","requiredAction":"Apply updates per vendor instructions.","notes":"SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso;  https://nvd.nist.gov/vuln/detail/CVE-2022-22536","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-22536"},{"cveID":"CVE-2021-38163","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Unrestricted File Upload Vulnerability","dateAdded":"2022-06-09","dueDate":"2022-06-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-23"],"shortDescription":"SAP NetWeaver contains a vulnerability that allows unrestricted file upload.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38163","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-38163"},{"cveID":"CVE-2016-2388","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Information Disclosure Vulnerability","dateAdded":"2022-06-09","dueDate":"2022-06-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-200"],"shortDescription":"The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-2388","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-2388"},{"cveID":"CVE-2016-2386","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver SQL Injection Vulnerability","dateAdded":"2022-06-09","dueDate":"2022-06-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-89"],"shortDescription":"SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-2386","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-2386"},{"cveID":"CVE-2020-6287","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-6287","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-6287"},{"cveID":"CVE-2020-6207","vendorProject":"SAP","product":"Solution Manager","vulnerabilityName":"SAP Solution Manager Missing Authentication for Critical Function Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-306"],"shortDescription":"SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-6207","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-6207"},{"cveID":"CVE-2018-2380","vendorProject":"SAP","product":"Customer Relationship Management (CRM)","vulnerabilityName":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-2380","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-2380"},{"cveID":"CVE-2016-9563","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver XML External Entity (XXE) Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-611"],"shortDescription":"SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-9563","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2016-9563"},{"cveID":"CVE-2016-3976","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Directory Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3976","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2016-3976"},{"cveID":"CVE-2010-5326","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-5326","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2010-5326"}]}