SAP
SAP known exploited vulnerabilities
Every SAP vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first. 3 of them are known to be used by ransomware.
14 CVEs
- CVE-2025-42999 ransomwareSAP NetWeaver Deserialization Vulnerability · added May 15, 2025
- CVE-2025-31324 ransomwareSAP NetWeaver Unrestricted File Upload Vulnerability · added April 29, 2025
- CVE-2017-12637SAP NetWeaver Directory Traversal Vulnerability · added March 19, 2025
- CVE-2019-0344SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability · added September 30, 2024
- CVE-2022-22536SAP Multiple Products HTTP Request Smuggling Vulnerability · added August 18, 2022
- CVE-2021-38163SAP NetWeaver Unrestricted File Upload Vulnerability · added June 9, 2022
- CVE-2016-2388SAP NetWeaver Information Disclosure Vulnerability · added June 9, 2022
- CVE-2016-2386SAP NetWeaver SQL Injection Vulnerability · added June 9, 2022
- CVE-2020-6287SAP NetWeaver Missing Authentication for Critical Function Vulnerability · added November 3, 2021
- CVE-2020-6207SAP Solution Manager Missing Authentication for Critical Function Vulnerability · added November 3, 2021
- CVE-2018-2380 ransomwareSAP Customer Relationship Management (CRM) Path Traversal Vulnerability · added November 3, 2021
- CVE-2016-9563SAP NetWeaver XML External Entity (XXE) Vulnerability · added November 3, 2021
- CVE-2016-3976SAP NetWeaver Directory Traversal Vulnerability · added November 3, 2021
- CVE-2010-5326SAP NetWeaver Remote Code Execution Vulnerability · added November 3, 2021
Source: CISA Known Exploited Vulnerabilities Catalog (public domain).