Exploited vulnerabilities
SAP
14 SAP vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.
In the catalogue14
Last 12 months0
In ransomware campaigns3
Last addition15 May 2025
The vulnerabilities14
- 15 May 2025CVE-2025-42999NetWeaverSAP NetWeaver Deserialization VulnerabilityRansomware
- 29 April 2025CVE-2025-31324NetWeaverSAP NetWeaver Unrestricted File Upload VulnerabilityRansomware
- 19 March 2025CVE-2017-12637NetWeaverSAP NetWeaver Directory Traversal Vulnerability
- 30 September 2024CVE-2019-0344Commerce CloudSAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
- 18 August 2022CVE-2022-22536Multiple ProductsSAP Multiple Products HTTP Request Smuggling Vulnerability
- 9 June 2022CVE-2021-38163NetWeaverSAP NetWeaver Unrestricted File Upload Vulnerability
- 9 June 2022CVE-2016-2388NetWeaverSAP NetWeaver Information Disclosure Vulnerability
- 9 June 2022CVE-2016-2386NetWeaverSAP NetWeaver SQL Injection Vulnerability
- 3 November 2021CVE-2020-6287NetWeaverSAP NetWeaver Missing Authentication for Critical Function Vulnerability
- 3 November 2021CVE-2020-6207Solution ManagerSAP Solution Manager Missing Authentication for Critical Function Vulnerability
- 3 November 2021CVE-2018-2380Customer Relationship Management (CRM)SAP Customer Relationship Management (CRM) Path Traversal VulnerabilityRansomware
- 3 November 2021CVE-2016-9563NetWeaverSAP NetWeaver XML External Entity (XXE) Vulnerability
- 3 November 2021CVE-2016-3976NetWeaverSAP NetWeaver Directory Traversal Vulnerability
- 3 November 2021CVE-2010-5326NetWeaverSAP NetWeaver Remote Code Execution Vulnerability
Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.
Alerts only on the products you use
With My Defence you receive alerts and briefings only on the products you use, SAP included.