Uptime Report Research · Patch Day Ledger
SAP NetWeaver Vulnerabilities: 75 CVEs in 2026, a Record Year, and 27 on November’s Patch Day Alone
As of November 13, 2026, NVD lists 543 SAP NetWeaver vulnerabilities. 75 were published in 2026, through SAP’s November 10 Patch Day, more than any full year before it, and 27 of them landed on that one day. 16 of the 2026 CVEs score 9.0 or higher. CISA’s KEV catalog holds 11 NetWeaver CVEs; the newest two, CVE-2025-31324 and CVE-2025-42999 in Visual Composer, carry a known ransomware flag.
Latest: SAP Security Patch Day, November 10, 2026
27 NetWeaver CVEs
6 rated 9.0 or higher
24 SAP notes
0 in CISA KEV (Nov 10 catalog)
| CVE | CVSS | Component | Product as SAP names it | SAP note |
|---|---|---|---|---|
| CVE-2026-120017 | 10.0 | AS ABAP | SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) | 3849308 |
| CVE-2026-76964 | 10.0 | Kernel and network services | SAP NetWeaver AS ABAP (Internet Communication Manager) | 3778530 |
| CVE-2026-109795 | 9.9 | Other NetWeaver | S4CRM | 3834842 |
| CVE-2026-109803 | 9.9 | Enterprise Portal and KM | SAP NetWeaver Knowledge Management (XML Forms) | 3809153 |
| CVE-2026-76965 | 9.9 | AS ABAP | SAP NetWeaver and ABAP Platform | 3792735 |
| CVE-2026-89119 | 9.6 | Kernel and network services | SAP Web Dispatcher and Internet Communication Manager | 3804858 |
| CVE-2026-76966 | 8.9 | AS ABAP | SAP NetWeaver and ABAP Platform | 3769130 |
| CVE-2026-120008 | 8.2 | Kernel and network services | SAP NetWeaver (Internet Graphics Service) | 3809953 |
| CVE-2026-109793 | 7.5 | Kernel and network services | SAP NetWeaver Application Server ABAP (Internet Communication… | 3808627 |
| CVE-2026-109794 | 7.5 | Kernel and network services | SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web… | 3805681 |
| CVE-2026-109806 | 7.5 | Kernel and network services | SAP NetWeaver (Internet Graphics Service) | 3809934 |
| CVE-2026-109807 | 7.5 | Kernel and network services | SAP NetWeaver (Internet Graphics Service) | 3809934 |
| CVE-2026-120010 | 7.5 | Kernel and network services | SAP NetWeaver Application Server (SAP Message Server) | 3805570 |
| CVE-2026-76970 | 7.5 | AS ABAP | SAP NetWeaver and ABAP Platform | 3792915 |
| CVE-2026-76973 | 7.5 | Kernel and network services | SAP NetWeaver and ABAP Platform (SAP Message Server) | 3789273 |
| CVE-2026-89114 | 7.5 | AS Java | SAP NetWeaver AS Java EDM Application | 3810485 |
| CVE-2026-109801 | 6.5 | AS Java | SAP NetWeaver Application Server Java (NWDI Cockpit) | 3839977 |
| CVE-2026-109802 | 6.5 | AS ABAP | SAP NetWeaver Application Server for ABAP | 3793716 |
| CVE-2026-109809 | 6.5 | AS Java | SAP NetWeaver Application Server Java (NWDI Cockpit) | 3839977 |
| CVE-2026-109811 | 6.5 | AS ABAP | SAP NetWeaver and ABAP Platform (Application Server ABAP) | 3805959 |
| CVE-2026-109805 | 6.4 | AS ABAP | SAP NetWeaver and ABAP Platform (Application Server ABAP) | 3786876 |
| CVE-2026-109810 | 6.1 | AS Java | SAP NetWeaver Application Server Java (Web Dynpro Java) | 3797108 |
| CVE-2026-120016 | 6.1 | Visual Composer | SAP NetWeaver Visual Composer | 3806484 |
| CVE-2026-89129 | 5.8 | AS Java | SAP NetWeaver AS Java (Web Services) | 3835738 |
| CVE-2026-89128 | 5.3 | Process Integration | SAP NetWeaver AS Java (Process Integration Test Tool) | 3792447 |
| CVE-2026-109796 | 4.3 | AS ABAP | SAP NetWeaver and ABAP Platform | 3769130 |
| CVE-2026-89131 | 4.3 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal | 3801587 |
Scores are SAP’s own CVSS 3.1 ratings as the CNA where present, otherwise NVD’s. Red rows: 9.0 or higher. Note numbers are taken from each CVE’s NVD references; the notes themselves need an SAP login.
Key findings
- 75 SAP NetWeaver CVEs were published from January 1 to November 13, 2026, against 60 in the same period of 2025 and a previous full-year high of 62 in 2025.
- SAP’s November 10, 2026 Patch Day added 27 NetWeaver CVEs under 24 SAP notes, 6 of them rated 9.0 or higher, the most for any single day in our data.
- 16 NetWeaver CVEs in 2026 score 9.0 or higher, up from 11 in the same months of 2025; the previous full-year high was 11 in 2025.
- 11 NetWeaver CVEs are in CISA’s Known Exploited Vulnerabilities catalog. None was added in 2026; the last was CVE-2025-42999 on May 15, 2025.
- CVE-2025-31324 went from publication to KEV in 5 days and CVE-2025-42999 in 2. 7 of the other KEV entries were listed more than a year after publication, 4 of them on the catalog’s first day.
- AS ABAP accounts for 37 of the 75 CVEs in 2026; Visual Composer, the component behind both 2025 KEV entries, has 8 CVEs in all.
- 324 of the 543 CVEs list release 7.50 (or SAP_BASIS 750) as affected and 182 list 7.53 or SAP_BASIS 753.
SAP NetWeaver vulnerabilities by Patch Day, 2019 to 2026
Each cell is one month of NetWeaver CVEs. Since 2020, 95% of them were published on the second Tuesday of the month (or within a day of it in UTC), which is SAP’s Security Patch Day. The exceptions are emergency releases such as CVE-2025-31324 on Thursday, April 24, 2025. 3 NetWeaver CVEs since 2023 fall outside that window.
Figure 1. SAP NetWeaver CVEs published per month, January 2019 to November 2026
Months use the NVD publication date. 2026 runs to November 13; December 2026 is blank. Hover a cell for the count and any KEV entries.
The yearly totals jumped twice: from 27 in 2019 to 55 in 2020, and from 40 in 2024 to 62 in 2025 and 75 so far in 2026. The November 2026 cell, with 27, is the largest in the series; the next biggest month is Jun 2021 with 18. NVD has not finished its own analysis of most new records: 55 of the 75 CVEs from 2026 are still awaiting or undergoing analysis, so 69 of them carry only the score SAP assigned as the CVE Numbering Authority.
Critical SAP NetWeaver vulnerabilities since 2023
35 NetWeaver CVEs published since January 2023 score 9.0 or higher. 13 of them need no privileges at all (PR:N in the CVSS vector), which is the group to patch first on any system reachable from the internet. For a cross-vendor view, our CVE statistics for 2026 track how many critical CVEs all vendors published this year.
| Published | CVE | CVSS | Component | What it is (NVD description, shortened) | SAP note | KEV |
|---|---|---|---|---|---|---|
| Nov 10, 2026 | CVE-2026-89119 | 9.6 | Kernel and network services | SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in… | 3804858 | |
| Nov 10, 2026 | CVE-2026-76965 | 9.9 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An… | 3792735 | |
| Nov 10, 2026 | CVE-2026-76964 | 10.0 | Kernel and network services | SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated… | 3778530 | |
| Nov 10, 2026 | CVE-2026-120017 | 10.0 | AS ABAP | SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain… | 3849308 | |
| Nov 10, 2026 | CVE-2026-109803 | 9.9 | Enterprise Portal and KM | SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected… | 3809153 | |
| Nov 10, 2026 | CVE-2026-109795 | 9.9 | Other NetWeaver | SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An… | 3834842 | |
| Oct 13, 2026 | CVE-2026-89110 | 9.9 | Visual Composer | SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges… | 3797111 | |
| Sep 8, 2026 | CVE-2026-58240 | 9.8 | Kernel and network services | SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An… | 3759472 | |
| Aug 11, 2026 | CVE-2026-34265 | 9.8 | AS ABAP | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory… | 3714806 | |
| Jul 14, 2026 | CVE-2026-44747 | 9.9 | AS ABAP | SAP NetWeaver Application Server ABAP allows an authenticated attacker to use logical errors in memory management to cause a memory corruption… | 3747367 | |
| Jun 9, 2026 | CVE-2026-44748 | 9.9 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message… | 3746332 | |
| Jun 9, 2026 | CVE-2026-40128 | 9.0 | AS Java | SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates… | 3727078 | |
| Jun 9, 2026 | CVE-2026-27671 | 9.8 | AS ABAP | Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an… | 3717897 | |
| Mar 10, 2026 | CVE-2026-27685 | 9.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon… | 3714585 | |
| Feb 10, 2026 | CVE-2026-0509 | 9.6 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls… | 3674774 | |
| Feb 10, 2026 | CVE-2026-0488 | 9.9 | Other NetWeaver | An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute… | 3697099 | |
| Sep 9, 2025 | CVE-2025-42958 | 9.1 | Other NetWeaver | Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users… | 3627373 | |
| Sep 9, 2025 | CVE-2025-42944 | 10.0 | AS Java | Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by… | 3634501, 3660659, 3670067 | |
| Sep 9, 2025 | CVE-2025-42922 | 9.9 | AS Java | SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary… | 3643865 | |
| Jul 8, 2025 | CVE-2025-42980 | 9.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which,… | 3620498 | |
| Jul 8, 2025 | CVE-2025-42966 | 9.1 | AS Java | SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java… | 3610892 | |
| Jul 8, 2025 | CVE-2025-42964 | 9.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when… | 3621236 | |
| Jul 8, 2025 | CVE-2025-42963 | 9.1 | AS Java | A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java… | 3621771 | |
| May 13, 2025 | CVE-2025-42999 | 9.1 | Visual Composer | SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when… | 3604119 | KEV, Known ransomware |
| Apr 24, 2025 | CVE-2025-31324 | 10.0 | Visual Composer | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially… | 3594142 | KEV, Known ransomware |
| Jan 14, 2025 | CVE-2025-0070 | 9.9 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by… | 3537476 | |
| Jan 14, 2025 | CVE-2025-0066 | 9.9 | AS ABAP | Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted… | 3550708 | |
| Mar 12, 2024 | CVE-2024-22127 | 9.1 | AS Java | SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) – version 7.50, allows an attacker with high privileges to upload… | 3433192 | |
| Sep 12, 2023 | CVE-2023-40309 | 9.8 | Kernel and network services | SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an… | 3340576 | |
| Jul 11, 2023 | CVE-2023-36922 | 9.1 | Other NetWeaver | Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an… | 3350297 | |
| Mar 14, 2023 | CVE-2023-27500 | 9.6 | AS ABAP | An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this… | 3302162 | |
| Mar 14, 2023 | CVE-2023-27269 | 9.6 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform – versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791,… | 3294595 | |
| Mar 14, 2023 | CVE-2023-23857 | 9.9 | AS Java | Due to missing authentication check, SAP NetWeaver AS for Java – version 7.50, allows an unauthenticated attacker to attach to an open interface… | 3252433 | |
| Jan 10, 2023 | CVE-2023-0017 | 9.4 | AS Java | An unauthenticated attacker in SAP NetWeaver AS for Java – version 7.50, due to improper access control, can attach to an open interface and make… | 3268093 | |
| Jan 10, 2023 | CVE-2023-0014 | 9.0 | AS ABAP | SAP NetWeaver ABAP Server and ABAP Platform – versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757,… | 3089413 |
Exploited SAP NetWeaver vulnerabilities: the KEV record
CISA’s catalog, release 2026.11.10 of Nov 10, 2026, lists 14 SAP CVEs, and 11 of them are NetWeaver CVEs by our definition. 4 were added on the catalog’s first day, Nov 3, 2021, each more than a year after publication. CVE-2017-12637, a directory traversal fixed in 2017, was added on March 19, 2025, 2,781 days after publication.
The 2025 Visual Composer pair moved far faster. CVE-2025-31324, a missing authorization check in the Visual Composer metadata uploader that lets an unauthenticated attacker upload executables (SAP’s CVSS 10.0), was published outside the Patch Day cycle on April 24, 2025 and added to KEV 5 days later. CVE-2025-42999, the deserialization flaw fixed on the May 13, 2025 Patch Day, followed in 2 days. They are the only NetWeaver entries with KEV’s known ransomware use flag. Canada’s Cyber Centre, in alert AL25-006 of May 21, 2025, said it was aware of reports that CVE-2025-31324 had been exploited since March 2025 and pointed to SAP notes 3594142 and 3604119. The 2026 CISA KEV analysis has the catalog-wide numbers.
Figure 2. From NVD publication to CISA KEV listing, 11 SAP NetWeaver CVEs
| CVE | KEV name | Component | CVSS | Published | Added to KEV | Days | Ransomware use | SAP note |
|---|---|---|---|---|---|---|---|---|
| CVE-2010-5326 | SAP NetWeaver Remote Code Execution Vulnerability | AS Java | 10.0 | May 13, 2016 | Nov 3, 2021 | 2,000 | Unknown | 1445998 |
| CVE-2016-3976 | SAP NetWeaver Directory Traversal Vulnerability | AS Java | 7.5 | Apr 7, 2016 | Nov 3, 2021 | 2,036 | Unknown | 2234971 |
| CVE-2016-9563 | SAP NetWeaver XML External Entity (XXE) Vulnerability | AS Java | 6.5 | Nov 23, 2016 | Nov 3, 2021 | 1,806 | Unknown | 2296909 |
| CVE-2020-6287 | SAP NetWeaver Missing Authentication for Critical Function Vulnerability | AS Java | 10.0 | Jul 14, 2020 | Nov 3, 2021 | 477 | Unknown | 2934135 |
| CVE-2016-2386 | SAP NetWeaver SQL Injection Vulnerability | Process Integration | 9.8 | Feb 16, 2016 | Jun 9, 2022 | 2,305 | Unknown | none in NVD record |
| CVE-2016-2388 | SAP NetWeaver Information Disclosure Vulnerability | AS Java | 5.3 | Feb 16, 2016 | Jun 9, 2022 | 2,305 | Unknown | none in NVD record |
| CVE-2021-38163 | SAP NetWeaver Unrestricted File Upload Vulnerability | Visual Composer | 9.9 | Sep 14, 2021 | Jun 9, 2022 | 268 | Unknown | 3084487 |
| CVE-2022-22536 | SAP Multiple Products HTTP Request Smuggling Vulnerability | Kernel and network services | 10.0 | Feb 9, 2022 | Aug 18, 2022 | 190 | Unknown | 3123396 |
| CVE-2017-12637 | SAP NetWeaver Directory Traversal Vulnerability | AS Java | 7.5 | Aug 7, 2017 | Mar 19, 2025 | 2,781 | Unknown | none in NVD record |
| CVE-2025-31324 | SAP NetWeaver Unrestricted File Upload Vulnerability | Visual Composer | 10.0 | Apr 24, 2025 | Apr 29, 2025 | 5 | Known | 3594142 |
| CVE-2025-42999 | SAP NetWeaver Deserialization Vulnerability | Visual Composer | 9.1 | May 13, 2025 | May 15, 2025 | 2 | Known | 3604119 |
The other 3 SAP entries in KEV are outside NetWeaver: CVE-2018-2380 (Customer Relationship Management (CRM)), CVE-2020-6207 (Solution Manager), CVE-2019-0344 (Commerce Cloud). CVE-2022-22536 (HTTP request smuggling in the ICM) is filed under “Multiple Products” in KEV and counts here because its CVE record names SAP NetWeaver and ABAP Platform.
SAP NetWeaver vulnerabilities by component
We sorted each CVE by the product name SAP gives in its CVE record (or, for older records, the NVD description). AS ABAP has had the most CVEs every year since 2020, while the exploited ones cluster on the Java side: 10 of the 11 KEV entries are in AS Java, Visual Composer or Process Integration.
Figure 3. SAP NetWeaver CVEs per year by component
| Component | CVEs, all years | 2025 | 2026* | CVSS 9.0+ | In KEV | Latest CVE |
|---|---|---|---|---|---|---|
| AS ABAP | 201 | 36 | 37 | 19 | 0 | 2026-11-10 |
| AS Java | 132 | 14 | 12 | 20 | 6 | 2026-11-10 |
| Kernel and network services | 61 | 1 | 11 | 9 | 1 | 2026-11-10 |
| Enterprise Portal and KM | 60 | 5 | 8 | 5 | 0 | 2026-11-10 |
| Visual Composer | 8 | 3 | 2 | 4 | 3 | 2026-11-10 |
| Process Integration | 31 | 0 | 1 | 4 | 1 | 2026-11-10 |
| Other NetWeaver | 50 | 3 | 4 | 8 | 0 | 2026-11-10 |
*2026 to November 13. Kernel and network services covers the kernel, ICM, Message Server, Web Dispatcher, Gateway, IGS and host agent. Other NetWeaver holds records that name NetWeaver but no single component, such as NetWeaver 7.0 before SP15.
SAP NetWeaver 7.5 and 7.53 vulnerabilities
SAP lists affected versions per component, so “7.5” appears in two forms: 7.50 on Java components (for example VCFRAMEWORK 7.50 or SERVERCORE 7.50) and 750 on ABAP components such as SAP_BASIS 750. “7.53” is mostly a kernel release (KERNEL 7.53, KRNL64UC 7.53), while 753 is an SAP_BASIS release. A CVE that lists a release is in this count only if SAP or NVD named that release as affected.
| Release as written in the CVE record | CVEs | 2025 | 2026 | CVSS 9.0+ | In KEV | KEV CVEs |
|---|---|---|---|---|---|---|
| 7.50 (any form) | 324 | 46 | 46 | 37 | 6 | CVE-2016-9563, CVE-2017-12637, CVE-2020-6287, CVE-2021-38163, CVE-2025-31324, CVE-2025-42999 |
| written 7.50 or 7.5 (Java stack, Portal, Visual Composer, kernel) | 198 | 23 | 25 | 27 | 4 | CVE-2020-6287, CVE-2021-38163, CVE-2025-31324, CVE-2025-42999 |
| written 750 (SAP_BASIS 750 and other ABAP components) | 118 | 23 | 21 | 9 | 0 | none |
| 7.53 (any form) | 182 | 33 | 41 | 22 | 1 | CVE-2022-22536 |
| written 7.53 (kernel, Web Dispatcher) | 82 | 11 | 21 | 14 | 1 | CVE-2022-22536 |
| written 753 (SAP_BASIS 753 and other ABAP components) | 99 | 22 | 20 | 9 | 0 | none |
Filter every NetWeaver CVE since 2023
| Published | CVE | CVSS | Component | Description (shortened) | SAP note |
|---|---|---|---|---|---|
| 2026-11-10 | CVE-2026-89131 | 4.3 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request… | 3801587 |
| 2026-11-10 | CVE-2026-89129 | 5.8 | AS Java | Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS Java (Web Services), an… | 3835738 |
| 2026-11-10 | CVE-2026-89128 | 5.3 | Process Integration | Due to Broken Access Control in SAP NetWeaver AS Java, an unauthenticated attacker could invoke affected SOAP… | 3792447 |
| 2026-11-10 | CVE-2026-89119 | 9.6 | Kernel and network services | SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform… | 3804858 |
| 2026-11-10 | CVE-2026-89114 | 7.5 | AS Java | SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An… | 3810485 |
| 2026-11-10 | CVE-2026-76973 | 7.5 | Kernel and network services | Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an… | 3789273 |
| 2026-11-10 | CVE-2026-76970 | 7.5 | AS ABAP | Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an… | 3792915 |
| 2026-11-10 | CVE-2026-76966 | 8.9 | AS ABAP | Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and… | 3769130 |
| 2026-11-10 | CVE-2026-76965 | 9.9 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain… | 3792735 |
| 2026-11-10 | CVE-2026-76964 | 10.0 | Kernel and network services | SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal… | 3778530 |
| 2026-11-10 | CVE-2026-120017 | 10.0 | AS ABAP | SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication… | 3849308 |
| 2026-11-10 | CVE-2026-120016 | 6.1 | Visual Composer | SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request… | 3806484 |
| 2026-11-10 | CVE-2026-120010 | 7.5 | Kernel and network services | SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling… | 3805570 |
| 2026-11-10 | CVE-2026-120008 | 8.2 | Kernel and network services | SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming… | 3809953 |
| 2026-11-10 | CVE-2026-109811 | 6.5 | AS ABAP | An internal ABAP HTTP component in SAP NetWeaver and ABAP Platform (Application Server ABAP) has SSRF vulnerability… | 3805959 |
| 2026-11-10 | CVE-2026-109810 | 6.1 | AS Java | SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters… | 3797108 |
| 2026-11-10 | CVE-2026-109809 | 6.5 | AS Java | SAP NetWeaver Application Server Java (NWDI Cockpit) does not perform sufficient authorization checks for certain… | 3839977 |
| 2026-11-10 | CVE-2026-109807 | 7.5 | Kernel and network services | SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming… | 3809934 |
| 2026-11-10 | CVE-2026-109806 | 7.5 | Kernel and network services | SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming… | 3809934 |
| 2026-11-10 | CVE-2026-109805 | 6.4 | AS ABAP | Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform… | 3786876 |
| 2026-11-10 | CVE-2026-109803 | 9.9 | Enterprise Portal and KM | SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations… | 3809153 |
| 2026-11-10 | CVE-2026-109802 | 6.5 | AS ABAP | SAP NetWeaver Application Server for ABAP does not properly validate certain input values. An authenticated user… | 3793716 |
| 2026-11-10 | CVE-2026-109801 | 6.5 | AS Java | SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain… | 3839977 |
| 2026-11-10 | CVE-2026-109796 | 4.3 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal… | 3769130 |
| 2026-11-10 | CVE-2026-109795 | 9.9 | Other NetWeaver | SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain… | 3834842 |
| 2026-11-10 | CVE-2026-109794 | 7.5 | Kernel and network services | SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource… | 3805681 |
| 2026-11-10 | CVE-2026-109793 | 7.5 | Kernel and network services | SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values… | 3808627 |
| 2026-10-13 | CVE-2026-89122 | 6.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An… | 3790401 |
| 2026-10-13 | CVE-2026-89118 | 5.3 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve… | 3789825 |
| 2026-10-13 | CVE-2026-89117 | 6.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter…. | 3779985 |
| 2026-10-13 | CVE-2026-89110 | 9.9 | Visual Composer | SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An… | 3797111 |
| 2026-10-13 | CVE-2026-76976 | 5.4 | AS ABAP | Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize… | 3671819 |
| 2026-10-13 | CVE-2026-58249 | 7.5 | Kernel and network services | SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled… | 3765424 |
| 2026-09-08 | CVE-2026-76967 | 7.8 | AS ABAP | SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data… | 3784138 |
| 2026-09-08 | CVE-2026-76963 | 4.3 | AS ABAP | Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated… | 3772838 |
| 2026-09-08 | CVE-2026-66767 | 7.7 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially… | 3757002 |
| 2026-09-08 | CVE-2026-58240 | 9.8 | Kernel and network services | SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server… | 3759472 |
| 2026-08-11 | CVE-2026-66779 | 6.3 | AS ABAP | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated… | 3721424 |
| 2026-08-11 | CVE-2026-58243 | 8.8 | AS ABAP | SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an… | 3772411 |
| 2026-08-11 | CVE-2026-58241 | 4.2 | AS ABAP | SAP NetWeaver and ABAP Platform (Change and Transport System – Customer Transport Integration Wizard) allows a… | 3752864 |
| 2026-08-11 | CVE-2026-58236 | 5.5 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing… | 3745182 |
| 2026-08-11 | CVE-2026-58235 | 6.3 | AS Java | SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data… | 3758318 |
| 2026-08-11 | CVE-2026-34265 | 9.8 | AS ABAP | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol… | 3714806 |
| 2026-07-28 | CVE-2026-58246 | 4.3 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a… | 3413033 |
| 2026-07-14 | CVE-2026-44760 | 4.7 | AS ABAP | Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP… | 3754659 |
| 2026-07-14 | CVE-2026-44759 | 6.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter…. | 3746678 |
| 2026-07-14 | CVE-2026-44752 | 8.2 | AS Java | SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through… | 3748227 |
| 2026-07-14 | CVE-2026-44747 | 9.9 | AS ABAP | SAP NetWeaver Application Server ABAP allows an authenticated attacker to use logical errors in memory management to… | 3747367 |
| 2026-06-09 | CVE-2026-44748 | 9.9 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to… | 3746332 |
| 2026-06-09 | CVE-2026-44746 | 6.1 | AS Java | Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver JAVA (JDBC Test Servlet), an… | 3723655 |
| 2026-06-09 | CVE-2026-40128 | 9.0 | AS Java | SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP… | 3727078 |
| 2026-06-09 | CVE-2026-27671 | 9.8 | AS ABAP | Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and… | 3717897 |
| 2026-05-14 | CVE-2026-27680 | 3.1 | AS ABAP | Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to… | 3665042 |
| 2026-05-12 | CVE-2026-40135 | 6.5 | AS ABAP | An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that… | 3730019 |
| 2026-05-12 | CVE-2026-40129 | 4.3 | AS ABAP | Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an… | 3735359 |
| 2026-05-12 | CVE-2026-27682 | 4.7 | AS ABAP | Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications… | 3728690 |
| 2026-04-14 | CVE-2026-34257 | 6.1 | AS ABAP | Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could… | 3692004 |
| 2026-04-14 | CVE-2026-27674 | 6.1 | AS Java | Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated… | 3719397 |
| 2026-03-10 | CVE-2026-27688 | 5.0 | AS ABAP | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with… | 3704740 |
| 2026-03-10 | CVE-2026-27685 | 9.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious… | 3714585 |
| 2026-03-10 | CVE-2026-27684 | 6.4 | Other NetWeaver | SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated… | 3697355 |
| 2026-03-10 | CVE-2026-24316 | 6.4 | AS ABAP | SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP… | 3689080 |
| 2026-03-10 | CVE-2026-24310 | 3.5 | AS ABAP | Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could… | 3694383 |
| 2026-03-10 | CVE-2026-24309 | 6.4 | AS ABAP | Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could… | 3703856 |
| 2026-02-10 | CVE-2026-24320 | 3.1 | AS ABAP | Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated… | 3678313 |
| 2026-02-10 | CVE-2026-23687 | 8.8 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to… | 3697567 |
| 2026-02-10 | CVE-2026-23686 | 3.4 | AS Java | Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with… | 3673213 |
| 2026-02-10 | CVE-2026-23685 | 4.4 | Other NetWeaver | Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator… | 3687285 |
| 2026-02-10 | CVE-2026-0509 | 9.6 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform… | 3674774 |
| 2026-02-10 | CVE-2026-0488 | 9.9 | Other NetWeaver | An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function… | 3697099 |
| 2026-02-10 | CVE-2026-0484 | 6.5 | AS ABAP | Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated… | 3672622 |
| 2026-01-13 | CVE-2026-0510 | 3.0 | AS Java | The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete… | 3593356 |
| 2026-01-13 | CVE-2026-0507 | 8.4 | AS ABAP | Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an… | 3675151 |
| 2026-01-13 | CVE-2026-0506 | 8.1 | AS ABAP | Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated… | 3688703 |
| 2026-01-13 | CVE-2026-0499 | 6.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter…. | 3687372 |
| 2025-12-09 | CVE-2025-42874 | 7.9 | Other NetWeaver | SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute… | 3640185 |
| 2025-12-09 | CVE-2025-42872 | 6.1 | Enterprise Portal and KM | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker… | 3662622 |
| 2025-11-11 | CVE-2025-42919 | 5.3 | AS Java | Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files… | 3643603 |
| 2025-11-11 | CVE-2025-42884 | 6.5 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a… | 3660969 |
| 2025-11-11 | CVE-2025-42883 | 2.7 | AS ABAP | Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when… | 3634053 |
| 2025-11-11 | CVE-2025-42882 | 4.3 | AS ABAP | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with… | 3643337 |
| 2025-10-14 | CVE-2025-42908 | 5.4 | AS ABAP | Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an… | 3642021 |
| 2025-10-14 | CVE-2025-42902 | 5.3 | AS ABAP | Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker… | 3627308 |
| 2025-09-09 | CVE-2025-42958 | 9.1 | Other NetWeaver | Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high… | 3627373 |
| 2025-09-09 | CVE-2025-42944 | 10.0 | AS Java | Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system… | 3634501, 3660659, 3670067 |
| 2025-09-09 | CVE-2025-42938 | 6.1 | AS ABAP | Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker… | 3629325 |
| 2025-09-09 | CVE-2025-42927 | 3.4 | AS Java | SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of… | 3525295 |
| 2025-09-09 | CVE-2025-42926 | 5.3 | AS Java | SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access… | 3619465 |
| 2025-09-09 | CVE-2025-42925 | 4.3 | AS Java | Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an… | 3640477 |
| 2025-09-09 | CVE-2025-42922 | 9.9 | AS Java | SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available… | 3643865 |
| 2025-09-09 | CVE-2025-42918 | 4.3 | AS ABAP | SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain… | 3623504 |
| 2025-09-09 | CVE-2025-42911 | 5.0 | Other NetWeaver | SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which… | 3627644 |
| 2025-08-12 | CVE-2025-42976 | 8.1 | AS ABAP | SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when… | 3611184 |
| 2025-08-12 | CVE-2025-42975 | 6.1 | AS ABAP | SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which,… | 3611184 |
| 2025-08-12 | CVE-2025-42948 | 6.1 | AS ABAP | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could… | 3629871 |
| 2025-08-12 | CVE-2025-42945 | 6.1 | AS ABAP | SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL… | 3585491 |
| 2025-08-12 | CVE-2025-42942 | 6.1 | AS ABAP | SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated… | 3597355 |
| 2025-08-12 | CVE-2025-42936 | 5.4 | AS ABAP | The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished… | 3602656 |
| 2025-08-12 | CVE-2025-42935 | 4.1 | Kernel and network services | The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized… | 3601480 |
| 2025-07-08 | CVE-2025-42981 | 6.1 | AS ABAP | Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could… | 3617131 |
| 2025-07-08 | CVE-2025-42980 | 9.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted… | 3620498 |
| 2025-07-08 | CVE-2025-42978 | 3.5 | AS Java | The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does… | 3557179 |
| 2025-07-08 | CVE-2025-42969 | 6.1 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious… | 3596987 |
| 2025-07-08 | CVE-2025-42968 | 5.0 | AS ABAP | SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could… | 3621037 |
| 2025-07-08 | CVE-2025-42966 | 9.1 | AS Java | SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit… | 3610892 |
| 2025-07-08 | CVE-2025-42964 | 9.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or… | 3621236 |
| 2025-07-08 | CVE-2025-42963 | 9.1 | AS Java | A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator… | 3621771 |
| 2025-07-08 | CVE-2025-42961 | 4.9 | AS ABAP | Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high… | 3610322 |
| 2025-07-08 | CVE-2025-42956 | 6.1 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious… | 3617131 |
| 2025-07-08 | CVE-2025-42954 | 2.7 | AS ABAP | SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing… | 3608156 |
| 2025-07-08 | CVE-2025-42953 | 8.1 | AS ABAP | SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user,… | 3623440 |
| 2025-06-10 | CVE-2025-42977 | 7.6 | Visual Composer | SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of… | 3610591 |
| 2025-06-10 | CVE-2025-31325 | 5.8 | AS ABAP | Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated… | 3590887 |
| 2025-05-13 | CVE-2025-42999 | 9.1 | Visual Composer | SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or… | 3604119 |
| 2025-05-13 | CVE-2025-31329 | 6.2 | AS ABAP | SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious… | 3577287 |
| 2025-04-24 | CVE-2025-31324 | 10.0 | Visual Composer | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing… | 3594142 |
| 2025-04-08 | CVE-2025-31331 | 4.3 | AS ABAP | SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that… | 3577131 |
| 2025-04-08 | CVE-2025-30015 | 4.1 | AS ABAP | Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform (Application Server ABAP),… | 3565944 |
| 2025-04-08 | CVE-2025-27437 | 4.3 | AS ABAP | A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application… | 3568778 |
| 2025-04-08 | CVE-2025-26653 | 4.7 | AS ABAP | SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored… | 3559307 |
| 2025-04-08 | CVE-2025-23186 | 8.5 | AS ABAP | In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote… | 3554667 |
| 2025-03-11 | CVE-2025-27431 | 5.4 | AS Java | User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting… | 3567246 |
| 2025-03-11 | CVE-2025-26661 | 8.8 | AS ABAP | Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access… | 3563927 |
| 2025-03-11 | CVE-2025-26659 | 6.1 | AS ABAP | SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to… | 3552824 |
| 2025-03-11 | CVE-2025-25242 | 6.1 | AS ABAP | SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially… | 3562390 |
| 2025-03-11 | CVE-2025-23194 | 5.3 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration… | 3561792 |
| 2025-02-11 | CVE-2025-24869 | 4.3 | AS Java | SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about… | 3550027 |
| 2025-02-11 | CVE-2025-23193 | 5.3 | AS ABAP | SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to… | 3561264 |
| 2025-02-11 | CVE-2025-0054 | 5.4 | AS Java | SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site… | 3526203 |
| 2025-01-14 | CVE-2025-0070 | 9.9 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate… | 3537476 |
| 2025-01-14 | CVE-2025-0068 | 4.3 | AS ABAP | An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks…. | 3550674 |
| 2025-01-14 | CVE-2025-0067 | 6.3 | AS Java | Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker… | 3540108 |
| 2025-01-14 | CVE-2025-0066 | 9.9 | AS ABAP | Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an… | 3550708 |
| 2025-01-14 | CVE-2025-0063 | 8.8 | AS ABAP | SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function… | 3550816 |
| 2025-01-14 | CVE-2025-0059 | 6.0 | AS ABAP | Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP store user input in the local… | 3503138 |
| 2025-01-14 | CVE-2025-0057 | 4.8 | AS Java | SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An… | 3514421 |
| 2025-01-14 | CVE-2025-0053 | 5.3 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system… | 3536461 |
| 2024-12-10 | CVE-2024-54198 | 8.5 | AS ABAP | In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote… | 3469791 |
| 2024-12-10 | CVE-2024-54197 | 7.2 | Other NetWeaver | SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints… | 3542543 |
| 2024-12-10 | CVE-2024-47585 | 4.3 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access… | 3536361 |
| 2024-11-12 | CVE-2024-47593 | 4.3 | AS ABAP | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the… | 3508947 |
| 2024-11-12 | CVE-2024-47592 | 5.3 | AS Java | SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify… | 3393899 |
| 2024-11-12 | CVE-2024-47588 | 4.7 | AS Java | In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters… | 3522953 |
| 2024-11-12 | CVE-2024-47586 | 5.3 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously… | 3504390 |
| 2024-11-12 | CVE-2024-42372 | 6.5 | AS Java | Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can… | 3335394 |
| 2024-10-08 | CVE-2024-47594 | 5.4 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site… | 3503462 |
| 2024-09-10 | CVE-2024-45283 | 6.0 | AS Java | SAP NetWeaver AS for Java allows an authorized attacker to obtain sensitive information. The attacker could obtain… | 3477359 |
| 2024-09-10 | CVE-2024-45280 | 4.8 | AS Java | Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be… | 3505503 |
| 2024-09-10 | CVE-2024-45279 | 6.1 | AS ABAP | Due to insufficient input validation, CRM Blueprint Application Builder Panel of SAP NetWeaver Application Server… | 3501359 |
| 2024-09-10 | CVE-2024-44120 | 4.7 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of… | 3498221 |
| 2024-09-10 | CVE-2024-44114 | 2.0 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program… | 3507252 |
| 2024-09-10 | CVE-2024-41728 | 2.7 | AS ABAP | Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker… | 3496410 |
| 2024-08-13 | CVE-2024-41734 | 4.3 | AS ABAP | Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated… | 3494349 |
| 2024-08-13 | CVE-2024-41732 | 4.7 | AS ABAP | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass… | 3468102 |
| 2024-08-13 | CVE-2024-33005 | 6.3 | Kernel and network services | Due to the missing authorization checks in the local systems, the admin users of SAP Web Dispatcher, SAP NetWeaver… | 3438085 |
| 2024-07-09 | CVE-2024-39599 | 4.7 | AS ABAP | Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer… | 3456952 |
| 2024-07-09 | CVE-2024-37180 | 4.1 | AS ABAP | Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access… | 3454858 |
| 2024-07-09 | CVE-2024-34685 | 6.1 | Enterprise Portal and KM | Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious… | 3468681 |
| 2024-06-11 | CVE-2024-34688 | 7.5 | AS Java | Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS… | 3460407 |
| 2024-06-11 | CVE-2024-33001 | 6.5 | AS ABAP | SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or… | 3453170 |
| 2024-06-11 | CVE-2024-28164 | 5.3 | AS Java | SAP NetWeaver AS Java (CAF – Guided Procedures) allows an unauthenticated user to access non-sensitive information… | 3425571 |
| 2024-05-14 | CVE-2024-34687 | 6.5 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs,… | 3448445 |
| 2024-05-14 | CVE-2024-32733 | 6.1 | AS ABAP | Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and… | 3450286 |
| 2024-04-09 | CVE-2024-30218 | 6.5 | AS ABAP | The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users… | 3359778 |
| 2024-04-09 | CVE-2024-27899 | 8.8 | AS Java | Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper… | 3434839 |
| 2024-04-09 | CVE-2024-27898 | 5.3 | Other NetWeaver | SAP NetWeaver application, due to insufficient input validation, allows an attacker to send a crafted request from a… | 3425188 |
| 2024-03-12 | CVE-2024-28163 | 5.3 | Process Integration | Under certain conditions, Support Web Pages of SAP NetWeaver Process Integration (PI) – versions 7.50, allows an… | 3434192 |
| 2024-03-12 | CVE-2024-27902 | 5.4 | AS ABAP | Applications based on SAP GUI for HTML in SAP NetWeaver AS ABAP – versions 7.89, 7.93, do not sufficiently encode… | 3377979 |
| 2024-03-12 | CVE-2024-25645 | 5.3 | Enterprise Portal and KM | Under certain condition SAP NetWeaver (Enterprise Portal) – version 7.50 allows an attacker to access information… | 3428847 |
| 2024-03-12 | CVE-2024-25644 | 5.3 | Other NetWeaver | Under certain conditions SAP NetWeaver WSRM – version 7.50, allows an attacker to access information which would… | 3425682 |
| 2024-03-12 | CVE-2024-22127 | 9.1 | AS Java | SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) – version 7.50, allows an attacker with high… | 3433192 |
| 2024-02-13 | CVE-2024-24743 | 8.6 | Enterprise Portal and KM | SAP NetWeaver AS Java (CAF – Guided Procedures) – version 7.50, allows an unauthenticated attacker to submit a… | 3426111 |
| 2024-02-13 | CVE-2024-24740 | 5.3 | Kernel and network services | SAP NetWeaver Application Server (ABAP) – versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89,… | 3360827 |
| 2024-02-13 | CVE-2024-22128 | 4.7 | AS ABAP | SAP NWBC for HTML – versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS… | 3396109 |
| 2024-02-13 | CVE-2024-22126 | 6.1 | AS Java | The User Admin application of SAP NetWeaver AS for Java – version 7.50, insufficiently validates and improperly… | 3417627, 3557138 |
| 2024-01-09 | CVE-2024-22124 | 4.1 | Kernel and network services | Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher – versions KERNEL 7.22, KERNEL… | 3392626 |
| 2024-01-09 | CVE-2024-21738 | 4.1 | AS ABAP | SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting… | 3387737 |
| 2023-12-12 | CVE-2023-49581 | 4.1 | AS ABAP | SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would… | 3392547 |
| 2023-11-14 | CVE-2023-42480 | 5.3 | AS Java | The unauthenticated attacker in NetWeaver AS Java Logon application – version 7.50, can brute force the login… | 3366410 |
| 2023-11-14 | CVE-2023-41366 | 5.3 | AS ABAP | Under certain condition SAP NetWeaver Application Server ABAP – versions KERNEL 722, KERNEL 7.53, KERNEL 7.77,… | 3362849 |
| 2023-10-10 | CVE-2023-42477 | 6.5 | AS Java | SAP NetWeaver AS Java (GRMG Heartbeat application) – version 7.50, allows an attacker to send a crafted request from… | 3333426 |
| 2023-09-12 | CVE-2023-41367 | 5.3 | Enterprise Portal and KM | Due to missing authentication check in webdynpro application, an unauthorized user in SAP NetWeaver (Guided… | 3348142 |
| 2023-09-12 | CVE-2023-40624 | 5.5 | AS ABAP | SAP NetWeaver AS ABAP (applications based on Unified Rendering) – versions SAP_UI 754, SAP_UI 755, SAP_UI 756,… | 3323163 |
| 2023-09-12 | CVE-2023-40309 | 9.8 | Kernel and network services | SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong… | 3340576 |
| 2023-09-12 | CVE-2023-40308 | 7.5 | Kernel and network services | SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port… | 3327896 |
| 2023-08-08 | CVE-2023-37492 | 4.9 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform – versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702,… | 3348000 |
| 2023-08-08 | CVE-2023-37488 | 6.1 | Process Integration | In SAP NetWeaver Process Integration – versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled… | 3350494 |
| 2023-07-11 | CVE-2023-36922 | 9.1 | Other NetWeaver | Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an… | 3350297 |
| 2023-07-11 | CVE-2023-35874 | 6.0 | AS ABAP | SAP NetWeaver Application Server ABAP and ABAP Platform – version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22,… | 3318850 |
| 2023-07-11 | CVE-2023-35873 | 6.5 | Process Integration | The Runtime Workbench (RWB) of SAP NetWeaver Process Integration – version SAP_XITOOL 7.50, does not perform… | 3343547 |
| 2023-07-11 | CVE-2023-35872 | 6.5 | Process Integration | The Message Display Tool (MDT) of SAP NetWeaver Process Integration – version SAP_XIAF 7.50, does not perform… | 3343564 |
| 2023-07-11 | CVE-2023-33989 | 8.7 | AS ABAP | An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) – versions 707, 737, 747, 757,… | 3331376 |
| 2023-07-11 | CVE-2023-31405 | 5.3 | AS Java | SAP NetWeaver AS for Java – versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated… | 3324732 |
| 2023-06-13 | CVE-2023-33985 | 6.1 | Enterprise Portal and KM | SAP NetWeaver Enterprise Portal – version 7.50, does not sufficiently encode user-controlled inputs over the… | 3331627 |
| 2023-06-13 | CVE-2023-33984 | 6.4 | AS Java | SAP NetWeaver (Design Time Repository) – version 7.50, returns an unfavorable content type for some versioned files,… | 3318657 |
| 2023-06-13 | CVE-2023-32114 | 2.7 | Other NetWeaver | SAP NetWeaver (Change and Transport System) – versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows… | 3325642 |
| 2023-05-09 | CVE-2023-30744 | 8.2 | AS Java | In SAP AS NetWeaver JAVA – versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker… | 3317453 |
| 2023-04-11 | CVE-2023-29186 | 8.7 | AS ABAP | In SAP NetWeaver (BI CONT ADDON) – versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw… | 3305907 |
| 2023-04-11 | CVE-2023-29185 | 5.3 | AS ABAP | SAP NetWeaver AS for ABAP (Business Server Pages) – versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755,… | 3303060 |
| 2023-04-11 | CVE-2023-28763 | 6.5 | AS ABAP | SAP NetWeaver AS for ABAP and ABAP Platform – versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an… | 3296378 |
| 2023-04-11 | CVE-2023-28761 | 6.5 | Enterprise Portal and KM | In SAP NetWeaver Enterprise Portal – version 7.50, an unauthenticated attacker can attach to an open interface and… | 3289994 |
| 2023-04-11 | CVE-2023-27499 | 6.1 | AS ABAP | SAP GUI for HTML – versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC… | 3275458 |
| 2023-04-11 | CVE-2023-24527 | 5.3 | AS Java | SAP NetWeaver AS Java for Deploy Service – version 7.5, does not perform any access control checks for… | 3287784 |
| 2023-03-14 | CVE-2023-27501 | 8.7 | AS ABAP | SAP NetWeaver AS for ABAP and ABAP Platform – versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756,… | 3294954 |
| 2023-03-14 | CVE-2023-27500 | 9.6 | AS ABAP | An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to… | 3302162 |
| 2023-03-14 | CVE-2023-27270 | 6.5 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform – versions 700, 701, 702, 731, 740, 750, 751, 752, 753,… | 3296328 |
| 2023-03-14 | CVE-2023-27269 | 9.6 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform – versions 700, 701, 702, 731, 740, 750, 751, 752, 753,… | 3294595 |
| 2023-03-14 | CVE-2023-27268 | 5.3 | AS Java | SAP NetWeaver AS Java (Object Analyzing Service) – version 7.50, does not perform necessary authorization checks,… | 3288480 |
| 2023-03-14 | CVE-2023-26461 | 6.8 | Enterprise Portal and KM | SAP NetWeaver allows (SAP Enterprise Portal) – version 7.50, allows an authenticated attacker with sufficient… | 3284550 |
| 2023-03-14 | CVE-2023-26460 | 5.3 | AS Java | Cache Management Service in SAP NetWeaver Application Server for Java – version 7.50, does not perform any… | 3288096 |
| 2023-03-14 | CVE-2023-26459 | 7.4 | AS ABAP | Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform – versions 700, 701, 702, 731, 740,… | 3296346 |
| 2023-03-14 | CVE-2023-25618 | 6.5 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform – versions 700, 701, 702, 731, 740, 750, 751, 752, 753,… | 3296346 |
| 2023-03-14 | CVE-2023-24526 | 5.3 | AS Java | SAP NetWeaver Application Server Java for Classload Service – version 7.50, does not perform any authentication… | 3288394 |
| 2023-03-14 | CVE-2023-23857 | 9.9 | AS Java | Due to missing authentication check, SAP NetWeaver AS for Java – version 7.50, allows an unauthenticated attacker to… | 3252433 |
| 2023-03-14 | CVE-2023-0021 | 6.1 | Other NetWeaver | Due to insufficient encoding of user input, SAP NetWeaver – versions 700, 701, 702, 731, 740, 750, allows an… | 3274920 |
| 2023-02-14 | CVE-2023-25614 | 6.1 | AS ABAP | SAP NetWeaver AS ABAP (BSP Framework) application – versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755,… | 3274585 |
| 2023-02-14 | CVE-2023-24529 | 6.1 | AS ABAP | Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) – versions 700, 701, 702, 731, 740, 750,… | 3282663 |
| 2023-02-14 | CVE-2023-24522 | 6.1 | AS ABAP | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) – versions 700, 701, 702, 731,… | 3269118 |
| 2023-02-14 | CVE-2023-24521 | 6.1 | AS ABAP | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) – versions 700, 701, 702, 731, 740,… | 3269151 |
| 2023-02-14 | CVE-2023-23860 | 6.1 | AS ABAP | SAP NetWeaver AS for ABAP and ABAP Platform – versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows… | 3268959 |
| 2023-02-14 | CVE-2023-23859 | 6.1 | AS ABAP | SAP NetWeaver AS for ABAP and ABAP Platform – versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows… | 3268959 |
| 2023-02-14 | CVE-2023-23858 | 6.1 | AS ABAP | Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform – versions 740, 750, 751, 752,… | 3293786 |
| 2023-02-14 | CVE-2023-23854 | 3.8 | AS ABAP | SAP NetWeaver Application Server for ABAP and ABAP Platform – versions 700, 701, 702, 731, 740, 750, 751, 752, does… | 3287291 |
| 2023-02-14 | CVE-2023-23853 | 6.1 | AS ABAP | An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform – versions 700, 702, 731,… | 3271227 |
| 2023-01-10 | CVE-2023-0017 | 9.4 | AS Java | An unauthenticated attacker in SAP NetWeaver AS for Java – version 7.50, due to improper access control, can attach… | 3268093 |
| 2023-01-10 | CVE-2023-0014 | 9.0 | AS ABAP | SAP NetWeaver ABAP Server and ABAP Platform – versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751,… | 3089413 |
| 2023-01-10 | CVE-2023-0013 | 6.1 | AS ABAP | The ABAP Keyword Documentation of SAP NetWeaver Application Server – versions 702, 731, 740, 750, 751, 752, 753,… | 3283283 |
227 CVEs from January 2023 to November 10, 2026. The CSV below has all 543.
RCE, command execution and deserialization flaws
Code and command execution
44 NetWeaver CVEs describe remote code execution, code or command injection, or are tagged CWE-94, CWE-77 or CWE-78. 14 of them were published in 2025 or 2026 and 17 score 9.0 or higher.
Deserialization
13 CVEs are tagged CWE-502 or describe deserialization of untrusted data, 9 of them since 2025, including CVE-2025-42999 in KEV. 3 are from 2026, among them CVE-2026-23685 in the JMS service.
| CWE | Weakness | CVEs | Since 2025 | CVSS 9.0+ |
|---|---|---|---|---|
| CWE-79 | Cross-site scripting | 120 | 23 | 1 |
| CWE-862 | Missing authorization | 48 | 23 | 5 |
| CWE-306 | Missing authentication for critical function | 20 | 2 | 7 |
| CWE-22 | Path traversal | 18 | 2 | 4 |
| CWE-200 | Information exposure | 15 | 0 | 0 |
| CWE-918 | Server-side request forgery | 15 | 3 | 3 |
| CWE-94 | Code injection | 15 | 7 | 5 |
| CWE-119 | Memory buffer errors | 14 | 0 | 3 |
| CWE-20 | Improper input validation | 13 | 0 | 2 |
| CWE-89 | SQL injection | 13 | 2 | 3 |
A CVE can carry more than one CWE. Cross-site scripting is the most common NetWeaver weakness, but only 1 of its 120 CVEs scores 9.0 or higher. Among CVEs rated 9.0 or higher, missing authentication (CWE-306) and deserialization (CWE-502) tie as the most common class with 7 each.
What is SAP NetWeaver?
SAP NetWeaver is SAP’s application server platform. One CVE record (CVE-2019-0271) describes the ABAP Server as “used in NetWeaver and Suite/ERP”. In the 543 records it appears as AS ABAP (the ABAP application server and SAP_BASIS), AS Java (with Enterprise Portal, Visual Composer and Process Integration on top), and the kernel and network services such as the ICM, Message Server and Web Dispatcher. The 27 CVEs from November 10 touch all 7 component groups used on this page, led by Kernel and network services with 9.
What this means for MSPs and SAP Basis teams
- Treat the November 10, 2026 Patch Day as a priority cycle: 6 NetWeaver CVEs at 9.0 or higher, including two rated 10.0 (CVE-2026-120017, CVE-2026-76964).
- Find out whether Visual Composer is deployed and reachable on any AS Java 7.50 system. It carries both 2025 KEV entries, and SAP published another Visual Composer CVE, CVE-2026-120016, on November 10.
- Put the ICM, Web Dispatcher, Message Server and IGS on the same patch clock as the application server: 11 of this year’s NetWeaver CVEs sit there, 9 of them from November 10 alone.
- Do not wait for KEV. In 2025 the gap from publication to KEV listing was 5 days for CVE-2025-31324; for the older entries KEV confirmed exploitation 190 to 2,781 days after publication. Our zero-day statistics count exploited zero-days by vendor since 2014.
- Each CVE record points to an SAP note (24 distinct notes for the 27 November CVEs). Record the note number next to the CVE ID in change tickets, because one note can fix several CVEs, as note 3809934 does for CVE-2026-109806 and CVE-2026-109807.
Frequently asked questions
What are the latest SAP NetWeaver vulnerabilities?
The latest are the 27 NetWeaver CVEs SAP published on its November 10, 2026 Patch Day. 6 score 9.0 or higher: CVE-2026-120017 (10.0, AS ABAP), CVE-2026-76964 (10.0, Kernel and network services), CVE-2026-109795 (9.9, S4CRM), CVE-2026-109803 (9.9, Enterprise Portal and KM), CVE-2026-76965 (9.9, AS ABAP), CVE-2026-89119 (9.6, Kernel and network services). None was in CISA’s KEV catalog as of its November 10, 2026 release.
Which SAP NetWeaver vulnerabilities are being exploited?
CISA’s KEV catalog lists 11 SAP NetWeaver CVEs. The two most recent are CVE-2025-31324 (Visual Composer metadata uploader, CVSS 10.0, added April 29, 2025) and CVE-2025-42999 (Visual Composer deserialization, 9.1, added May 15, 2025). Both carry KEV’s known ransomware use flag. No NetWeaver CVE has been added in 2026.
How many vulnerabilities does SAP NetWeaver have?
NVD lists 543 CVEs that name SAP NetWeaver or a NetWeaver product, from 2007 to November 10, 2026. 75 were published in 2026, the highest yearly count.
Is SAP NetWeaver 7.5 affected by CVE-2025-31324?
Yes. SAP’s CVE record lists one affected version, VCFRAMEWORK 7.50, for the product SAP NetWeaver (Visual Composer development server). SAP note 3594142 fixes it, and note 3604119 fixes the follow-on CVE-2025-42999. In total 324 NetWeaver CVEs list 7.50 or 750 as affected.
What is the SAP NetWeaver deserialization vulnerability?
The one in CISA’s KEV catalog is CVE-2025-42999, a deserialization flaw in Visual Composer (CVSS 9.1) that SAP fixed on May 13, 2025 with note 3604119; CISA added it to KEV two days later. NVD holds 13 NetWeaver CVEs that are tagged CWE-502 or describe deserialization.
Was the JLR cyberattack caused by an SAP NetWeaver vulnerability?
Searches link Jaguar Land Rover’s 2025 incident to SAP NetWeaver, but we found no primary source, such as a CISA advisory or a JLR statement, that names a CVE. We therefore do not tie the incident to any vulnerability in this list. The two NetWeaver CVEs with KEV’s known ransomware flag are CVE-2025-31324 and CVE-2025-42999.
Download the data. sap-netweaver-vulnerabilities.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.
Free to cite and republish with a link to this page.
Methodology
Sources. NVD CVE API 2.0, retrieved November 13, 2026: a keyword search for “NetWeaver” plus one CPE query per NVD product name beginning with “netweaver” (for example netweaver_application_server_java). CISA Known Exploited Vulnerabilities catalog JSON, version 2026.11.10.
Definition. A CVE is counted if its English NVD description names NetWeaver or NVD marks a netweaver CPE as vulnerable. Rejected records are excluded. That gives 543 CVEs from 2007 to Nov 10, 2026. Year and month use the NVD publication date.
Scores. SAP’s CVSS 3.x score as the CVE Numbering Authority where present, else NVD’s 3.x score, else NVD’s CVSS 2.0 score for old records. “Critical” here means 9.0 or higher.
SAP notes and Patch Days. Note numbers are parsed from each record’s reference URLs; 60 older records have none. SAP’s own sites (sap.com, support.sap.com) disallow automated access in robots.txt, so we did not fetch them; Patch Day membership is inferred from the publication date (second Tuesday of the month, plus or minus one day).
Components and releases. Components are assigned by matching keywords in SAP’s product name, then the description. Release counts match the affected versions in SAP’s CVE record and NVD’s CPE versions.
Limitations. A CVE affecting NetWeaver that never names it is missed. KEV flags record known exploitation and can lag. NVD analysis of 2026 records is incomplete.
Not advice. This is an analysis of public vulnerability data, not a patching instruction for any system. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Cite as:The Uptime Report. "SAP NetWeaver Vulnerabilities: 75 CVEs in 2026, a Record Year, and 27 on November's Patch Day Alone." November 2026. https://theuptimereport.com/sap-netweaver-vulnerabilities/
References
- NIST National Vulnerability Database, CVE API 2.0, keyword NetWeaver and per-product CPE queries. Accessed November 2026.
- CISA, Known Exploited Vulnerabilities Catalog (JSON feed, version 2026.11.10). Accessed November 2026.
- NVD, CVE-2025-31324. Accessed November 2026.
- NVD, CVE-2025-42999. Accessed November 2026.
- Canadian Centre for Cyber Security, Alert AL25-006, Vulnerabilities impacting SAP NetWeaver. Accessed November 2026.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- AT&T Data Breach Settlement Payout Date
AT&T payout status, tiers, incident history - Microsoft Data Breach History
Microsoft incidents by type, 2020 to 2026 - IC3 Report 2025
IC3 losses, crime types, states per capita - AI Incidents Statistics 2026
AI incidents by year, harm type, company - Cyber Attacks 2026
Every 2026 cyber attack, primary-sourced - WordPress Vulnerabilities
WordPress plugin, theme and core CVEs - Hypervisor Vulnerabilities
Hypervisor CVEs vs exploitation - DMARC Adoption Statistics 2026
DMARC enforcement, 15,000 domains - RMM Vulnerabilities and Remote Access Flaws
RMM and remote access flaws in KEV - Identity Theft Statistics 2026
ID theft per 100K by state and type - Scam Statistics 2026
FTC fraud losses by channel and age - VPN Vulnerabilities by Vendor
VPN gateway KEV and CVEs by vendor - MFA Statistics 2026
MFA methods across 2,571 services - Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Ransomware Statistics 2026
Leak-site victims by month since 2021 - Malicious npm Packages
Malicious npm packages, day by day - Cybersecurity Statistics 2026
70 sourced stats, every number traced - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021 - Disaster Declarations by State
FEMA data for continuity planning - Data Breach Statistics 2026
980 breaches in Have I Been Pwned - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend - ConnectWise ScreenConnect Vulnerabilities
ScreenConnect CVEs dated, with version lookup - SonicWall Vulnerabilities 2026
SonicWall CVEs by product line and KEV year - Dental Practice Data Breaches 2026
Every 2026 dental breach on the HHS portal - Apple Zero Days 2026 List
Every Apple-flagged CVE, with KEV dates - Android Zero Days 2026
Android flags by layer, OEM patch lag - Auto Dealership Data Breach 2026 Tracker
Dealer and vendor breaches by state filing - Law Firm Data Breaches 2026
Every law firm AG notice, sized and dated - Accounting Firm Data Breach 2026
CPA breach notices against the tax calendar - Bank DMARC Adoption 2026
DMARC at 4,118 US banks, by size - MSP Email Security
MSP DMARC and SPF, 1,430 domains - Credit Union Cybersecurity Statistics 2026
55% of credit unions skip DMARC - Citrix NetScaler Vulnerabilities 2026
48 NetScaler CVEs, 6 exploited, build checker - Fortinet Vulnerabilities 2026
Every 2026 Fortinet CVE, by product - Okta Vulnerabilities
Okta CVEs and incidents, two ledgers - Veeam Vulnerabilities
Veeam CVEs, fixed builds, KEV flags - Atlassian Confluence Vulnerabilities
Confluence CVEs, KEV and LTS fixes - SolarWinds Vulnerabilities
338 SolarWinds CVEs, 11 exploited in KEV - N-able Vulnerabilities
N-able CVEs, fixed builds and KEV flags
Infrastructure and uptime
- Data Centers Using Nuclear Power
Every US nuclear deal, by NRC stage - Claude Outage History
934 Claude incidents by model and hour - AMD vs Nvidia Market Share Over Time
AMD vs Nvidia share: Steam and SEC filings - iPhone Market Share by Country 2026
iPhone share in every country - Android Market Share by Version 2026
Android versions and patch status - OpenAI Outage History
1,051 OpenAI incidents, causes coded - Data Center Construction Spending 2026
Data center build spending, Census monthly - Microsoft End of Support 2026
Every 2026 Microsoft support cutoff - Fiber Internet Availability by State 2026
Fiber by state, build pace, top providers - 5G Coverage Map 2026
5G by state and carrier, FCC data - Cell Phone Outage History
FCC outages, DIRS cell sites, 911 fines - Mac Market Share 2026
Mac desktop share by country and version - Browser Market Share 2026
Browser share since 2009, by platform - Microsoft 365 Market Share 2026
Who runs email: Microsoft vs Google - CrowdStrike Outage
July 19, 2024 outage, minute by minute - Data Center Electricity Prices 2026
Power prices vs data center load, by state - Average Internet Bill 2026
Home internet prices by speed and state - Search Engine Market Share 2026
Search share since 2009, by country - ChatGPT Market Share 2026
AI chatbot referral share, every tracker - Google Cloud Outage History
Google Cloud incidents by product, 2013 on - Azure Outage History
Every Azure PIR, coded by root cause - Data Center Water Usage 2026
Water by site, company and drought - AI Energy Consumption 2026
Big Tech electricity vs US demand - SSD Prices 2026
NAND price cycle from makers’ filings - RAM Prices 2026
DRAM prices from producers’ filings - Domain Name Statistics 2026
Domains by TLD, renewals, registrars - Linux Market Share 2026
Linux desktop share, every headline traced - GitHub Outages
GitHub incidents by month since 2020 - Cloudflare Outage History
Every Cloudflare outage post-mortem - Starlink Statistics 2026
Satellites, subscribers, coverage, outages - Internet Access Statistics 2026
Home internet gaps by state and group - SQL Server End of Life
SQL Server support countdown + CVEs - Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version - SQL Server 2016 ESU Cost
ESU cost calculator, every formula - Slack Outage History
1,459 Slack entries, SLA history, ledger - Google Workspace vs Microsoft 365 in US Schools
Google vs Microsoft in 10,591 districts - Block GPTBot
AI crawler blocks across top 10k sites - security.txt Adoption 2026
Who publishes a valid security.txt - Government Email Security 2026
.gov DMARC: local 40% vs federal 88% - Government Website Security 2026
.gov web security scored by state - vSphere 8 End of Support
vSphere 8 dates, exploited flaws by version - Office 2019 End of Life
Office 2019 EOL: who still gets patches - Zoom Outage History
Every Zoom incident since 2015 - Office 2021 End of Life
177 flaws fixed a month after support ended - Exchange Server 2019 End of Life
Exchange 2019 EOL, ESU builds and CVEs - FortiOS 7.0 End of Life
FortiOS 7.0 dates, builds and unfixed flaws
Regulation and disclosure
- Are Ransomware Payments Illegal? Law by Jurisdiction
Who may pay a ransom, by jurisdiction - HIPAA Security Rule Changes 2026
Security Rule status: current vs proposed - FTC Safeguards Rule Breach Notification
500-consumer, 30-day FTC breach duty - Data Center Moratorium by State 2026
Moratoria and bans in every state - State Privacy Laws 2026
23 state privacy laws, compared - State AI Laws 2026
131 state AI laws, dates and penalties - FedRAMP Statistics 2026
FedRAMP authorizations, GSA data - Item 1C Cybersecurity Disclosures
What 600 10-Ks say in Item 1C - CMMC Certification Statistics 2026
CMMC demand vs assessor capacity - Data Brokers List 2026
728 brokers across three state registries - SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement - CMMC Level 2 Assessment Cost
CMMC Level 2 cost estimator, DoD figures - Safe Harbor Cybersecurity Laws by State
10 states, 11 laws, framework grid
Workforce and pay
- Intel Layoff Tracker
Every Intel WARN notice, by site and date - Amazon Layoffs by State
Amazon WARN notices, state by state - Oracle Layoffs by State
Oracle WARN notices and restructuring cost - Cloud Architect vs Cloud Engineer Salary
Architect vs engineer pay, H-1B filings - Entry Level DevOps Engineer Salary
Entry level DevOps pay, H-1B filings - Microsoft Layoff History Timeline
Every round dated, 2009 to 2026 - Google Layoffs by Year
Notices, headcount, severance by year - AI Engineer vs ML Engineer Salary
AI vs ML engineer pay, from H-1B filings - Data Engineer Salary by Experience
Data engineer pay by DOL wage level - Most Popular Programming Languages 2026
Language ranks by country, GitHub data - Computer Science Graduates Per Year
CS degrees per year, IPEDS 2011 to 2024 - Data Scientist Salary 2026
Data scientist pay ladder and metros, BLS - Web Developer Salary 2026
Web dev vs software pay by state, BLS - AI at Work Statistics 2026
Worker AI use: ever, weekly, daily, by job - Network Engineer Salary 2026
Network engineer vs admin pay, BLS - IT Manager Salary 2026
IT manager pay by industry, BLS OEWS - Software Engineer Salary 2026
Developer pay by metro, BLS OEWS - H-1B Statistics 2026
H-1B lottery, employers, and wages - AI Layoffs 2026
AI-blamed job cuts, sourced to filings - Help Desk Salary 2026
Help desk hourly pay, BLS OEWS - Cybersecurity Salary 2026
Security pay percentiles, BLS OEWS - Women in Tech Statistics 2026
Women’s share of tech jobs since 2011 - IT Unemployment Rate 2026
Tech vs national jobless rate, monthly - Tech Job Postings 2026
Tech postings vs 2020, by role and country - Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections - Salesforce Layoffs by State
Salesforce WARN notices, state by state - Dell Layoffs by Year
Headcount, severance, notices by year - IBM Layoffs by Year
IBM workforce charges against headcount - Meta Layoffs by Year
Meta rounds, sites and headcount by year - IT Director vs IT Manager Salary
IT director vs manager pay, H-1B filings - Penetration Tester Salary Entry Level
Entry level pen test pay, H-1B filings - Site Reliability Engineer vs DevOps Salary
SRE vs DevOps pay, H-1B filings - Solutions Architect vs Software Engineer Salary
Architect vs engineer pay, Level I to IV - Data Engineer vs Data Analyst Salary
Data engineer vs analyst pay, H-1B ledger - Network Engineer vs System Administrator Salary
Network engineer vs sysadmin pay by state - Security Analyst vs Security Engineer Salary
Analyst vs engineer pay, step by step - Cloud Engineer vs DevOps Engineer Salary
Cloud vs DevOps pay by metro, H-1B - Cisco Layoffs by Year
Cisco cuts by year: charges vs staff - Database Administrator vs Data Engineer Salary
DBA vs data engineer pay, reconciled - Penetration Tester vs Security Engineer Salary
Pen tester vs engineer pay: near tie - Help Desk vs Desktop Support Salary
Help desk vs desktop pay, one BLS code
MSP market and spending
- AI Capex 2026
Big Tech capex vs cash flow, SEC data - Cybersecurity Budget 2027
Federal and CISA cyber budgets, benchmarks - Microsoft 365 Price Increase 2026
Every M365 price change, vs inflation - Computer Prices 2026
Computer price indexes and HS 8471 imports - MSP Market Size 2026
Managed services market, built from Census - Small Business AI Adoption 2026
AI use by firm size, sector, state, Census - Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas - How Much Do MSPs Charge Per User?
Published MSP prices, 1,310 websites - VMware Price Increase Broadcom Timeline
Broadcom VMware changes and revenue, dated - Adobe Price Increase History
Every Adobe price change, vs inflation - Atlassian Price Increase History, 2019 to 2026
Every Atlassian price hike, dated - Zoom Price Increase 2026
Every Zoom price change since 2013
Leave a Reply