Cyberfeed6 › Vendors › SAP
CISA lists 14 SAP vulnerabilities as exploited in real attacks, and 3 of them are known to be used in ransomware campaigns. Most entries concern NetWeaver, Commerce Cloud, Multiple Products, Solution Manager.
Showing the 14 most recently added of 14. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2025-42999SAP NetWeaver Deserialization Vulnerability | NetWeaver | 2025-05-15 | Critical (9.1) | Yes | Vendor notice |
| CVE-2025-31324SAP NetWeaver Unrestricted File Upload Vulnerability | NetWeaver | 2025-04-29 | Critical (10.0) | Yes | Vendor notice |
| CVE-2017-12637SAP NetWeaver Directory Traversal Vulnerability | NetWeaver | 2025-03-19 | High (7.5) | No | Vendor notice |
| CVE-2019-0344SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | Commerce Cloud | 2024-09-30 | Critical (9.8) | No | Vendor notice |
| CVE-2022-22536SAP Multiple Products HTTP Request Smuggling Vulnerability | Multiple Products | 2022-08-18 | Critical (9.8) | No | Vendor notice |
| CVE-2021-38163SAP NetWeaver Unrestricted File Upload Vulnerability | NetWeaver | 2022-06-09 | Critical (9.9) | No | |
| CVE-2016-2388SAP NetWeaver Information Disclosure Vulnerability | NetWeaver | 2022-06-09 | Medium (5.3) | No | |
| CVE-2016-2386SAP NetWeaver SQL Injection Vulnerability | NetWeaver | 2022-06-09 | Critical (9.8) | No | |
| CVE-2020-6287SAP NetWeaver Missing Authentication for Critical Function Vulnerability | NetWeaver | 2021-11-03 | Critical (10.0) | No | |
| CVE-2020-6207SAP Solution Manager Missing Authentication for Critical Function Vulnerability | Solution Manager | 2021-11-03 | Critical (10.0) | No | |
| CVE-2018-2380SAP Customer Relationship Management (CRM) Path Traversal Vulnerability | Customer Relationship Management (CRM) | 2021-11-03 | Medium (6.6) | Yes | |
| CVE-2016-9563SAP NetWeaver XML External Entity (XXE) Vulnerability | NetWeaver | 2021-11-03 | Medium (6.5) | No | |
| CVE-2016-3976SAP NetWeaver Directory Traversal Vulnerability | NetWeaver | 2021-11-03 | High (7.5) | No | |
| CVE-2010-5326SAP NetWeaver Remote Code Execution Vulnerability | NetWeaver | 2021-11-03 | Critical (10.0) | No |
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.