[ Vendor · 28 CVEs ]
SAP_SE
CVEs affecting SAP_SE published in the last 30 days, plus any SAP_SE CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-89122 | 13 Oct 2026 | CVSS 6.1 | SAP_SE SAP NetWeaver Enterprise PortalSAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a… | |
| CVE-2026-89124 | 13 Oct 2026 | CVSS 4.3 | SAP_SE SAP HANA (Display Product Catalog Based on Customs Declaration)Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality… | |
| CVE-2026-89112 | 13 Oct 2026 | CVSS 6.5 | SAP_SE CLA-AssistantThe admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target… | |
| CVE-2026-89113 | 13 Oct 2026 | CVSS 8.8 | SAP_SE SAP Commerce Cloud (OOTB Code)SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user… | |
| CVE-2026-89116 | 13 Oct 2026 | CVSS 5.9 | SAP_SE SAP yeoman-uiThe affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute… | |
| CVE-2026-89117 | 13 Oct 2026 | CVSS 6.1 | SAP_SE SAP NetWeaver Enterprise PortalSAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the… | |
| CVE-2026-89118 | 13 Oct 2026 | CVSS 5.3 | SAP_SE SAP NetWeaver Enterprise PortalSAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information… | |
| CVE-2026-89120 | 13 Oct 2026 | CVSS 7.1 | SAP_SE SAP ABAP PlatformA regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened… | |
| CVE-2026-89121 | 13 Oct 2026 | CVSS 4.7 | SAP_SE SAP S/4HANA (Linear Asset Management RAP Business Object)SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data… | |
| CVE-2026-89105 | 13 Oct 2026 | CVSS 4.2 | SAP_SE SAP/cloud-security-services-integration-libraryThe HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA… | |
| CVE-2026-89106 | 13 Oct 2026 | CVSS 4.4 | SAP_SE SAPUI5SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted… | |
| CVE-2026-89107 | 13 Oct 2026 | CVSS 9.9 | SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules)SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a… | |
| CVE-2026-89108 | 13 Oct 2026 | CVSS 9.1 | SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service)SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An… | |
| CVE-2026-89110 | 13 Oct 2026 | CVSS 9.9 | SAP_SE SAP NetWeaver Visual ComposerSAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could… | |
| CVE-2026-89111 | 13 Oct 2026 | CVSS 10.0 | SAP_SE SAP CloudThe SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the… | |
| CVE-2026-58242 | 13 Oct 2026 | CVSS 3.5 | SAP_SE SAP Cloud ConnectorSAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted… | |
| CVE-2026-58249 | 13 Oct 2026 | CVSS 7.5 | SAP_SE SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component… | |
| CVE-2026-76972 | 13 Oct 2026 | CVSS 6.5 | SAP_SE SAP Manufacturing Integration and IntelligenceDue to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that… | |
| CVE-2026-76975 | 13 Oct 2026 | CVSS 6.1 | SAP_SE SAPUI5 (Support Assistant Overlay)Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly… | |
| CVE-2026-76976 | 13 Oct 2026 | CVSS 5.4 | SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain… | |
| CVE-2025-42999 | 13 May 2025 | CVSS 9.1 | SAP NetWeaver DeserializationSAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when… | Exploited |
| CVE-2025-31324 | 24 Apr 2025 | CVSS 9.8 | SAP NetWeaver Unrestricted File UploadSAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially… | Exploited |
| CVE-2022-22536 | 9 Feb 2022 | CVSS 10.0 | SAP Multiple Products HTTP Request SmugglingSAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are… | Exploited |
| CVE-2021-38163 | 14 Sep 2021 | CVSS 8.8 | SAP NetWeaver Unrestricted File UploadSAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user… | Exploited |
| CVE-2020-6287 | 14 Jul 2020 | CVSS 10.0 | SAP NetWeaver Missing Authentication for Critical FunctionSAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker… | Exploited |
| CVE-2020-6207 | 10 Mar 2020 | CVSS 9.8 | SAP Solution Manager Missing Authentication for Critical FunctionSAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a… | Exploited |
| CVE-2019-0344 | 14 Aug 2019 | CVSS 9.8 | SAP Commerce Cloud Deserialization of Untrusted DataDue to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to… | Exploited |
| CVE-2018-2380 | 1 Mar 2018 | CVSS 6.6 | SAP Customer Relationship Management (CRM) Path TraversalSAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus… | Exploited |