SAP known exploited vulnerabilities
The Beam CVE database tracks 14 known exploited vulnerabilities for SAP: 8 critical, 3 high and 3 medium severity. The newest is CVE-2025-42999, published May 13, 2025.
These are the SAP vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog: flaws with confirmed exploitation in the wild. Each entry links the vendor bulletin and CISA’s required action.
- Vulnerabilities tracked
- 14
- Critical
- 8
- Known exploited (CISA KEV)
- 14
- Published in the last 30 days
- 0
All entries, newest first
CVE-2025-42999
SAP NetWeaver Deserialization Vulnerability
critical9.1ExploitedMay 13, 2025CVE-2025-31324
SAP NetWeaver Unrestricted File Upload Vulnerability
critical9.8ExploitedApr 24, 2025CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
critical10.0ExploitedFeb 9, 2022CVE-2021-38163
SAP NetWeaver Unrestricted File Upload Vulnerability
high8.8ExploitedSep 14, 2021CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
critical10.0ExploitedJul 14, 2020CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
critical9.8ExploitedMar 10, 2020CVE-2019-0344
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
critical9.8ExploitedAug 14, 2019CVE-2018-2380
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
medium6.6ExploitedMar 1, 2018CVE-2017-12637
SAP NetWeaver Directory Traversal Vulnerability
high7.5ExploitedAug 7, 2017CVE-2016-9563
SAP NetWeaver XML External Entity (XXE) Vulnerability
medium6.5ExploitedNov 23, 2016CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability
critical10.0ExploitedMay 13, 2016CVE-2016-3976
SAP NetWeaver Directory Traversal Vulnerability
high7.5ExploitedApr 7, 2016CVE-2016-2386
SAP NetWeaver SQL Injection Vulnerability
critical9.8ExploitedFeb 16, 2016CVE-2016-2388
SAP NetWeaver Information Disclosure Vulnerability
medium5.3ExploitedFeb 16, 2016
