Skip to content
Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

SAP: actively exploited vulnerabilities

14 vulnerabilities in SAP products (NetWeaver, Commerce Cloud (Hybris), CRM…) are in CISA’s catalog of exploited vulnerabilities. Last added: May 15, 2025.

SAP security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one SAP category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Follow a single SAP product (NetWeaver, Commerce Cloud (Hybris)…) rather than the whole brand.

  • NetWeaver11 vulnerabilities, Business apps and data
  • Commerce Cloud (Hybris)1 vulnerability, CMS and websites
  • CRM1 vulnerability, Business apps and data
  • Solution Manager1 vulnerability, Business apps and data

Name used by CISA: SAP. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this SAP list.

  1. Rank 1

    SAP NetWeaverCVE-2022-22536

    SAP Multiple Products HTTP Request Smuggling Vulnerability

    CVSS severity 10.0critical

    Added Aug 18, 2022

  2. Rank 2

    SAP NetWeaverCVE-2010-5326

    SAP NetWeaver Remote Code Execution Vulnerability

    CVE from 2010, added in 2021

    CVSS severity 10.0critical

    Added Nov 3, 2021

  3. Rank 3

    SAP NetWeaverCVE-2020-6287

    SAP NetWeaver Missing Authentication for Critical Function Vulnerability

    CVSS severity 10.0critical

    Added Nov 3, 2021

  4. Rank 4

    SAP NetWeaverCVE-2025-31324

    SAP NetWeaver Unrestricted File Upload Vulnerability

    Ransomware

    CVSS severity 9.8critical

    Added Apr 29, 2025

  5. Rank 5

    SAP Commerce Cloud (Hybris)CVE-2019-0344

    SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

    CVE from 2019, added in 2024

    CVSS severity 9.8critical

    Added Sep 30, 2024

  6. Rank 6

    SAP NetWeaverCVE-2016-2386

    SAP NetWeaver SQL Injection Vulnerability

    CVE from 2016, added in 2022

    CVSS severity 9.8critical

    Added Jun 9, 2022

  7. Rank 7

    SAP Solution ManagerCVE-2020-6207

    SAP Solution Manager Missing Authentication for Critical Function Vulnerability

    CVSS severity 9.8critical

    Added Nov 3, 2021

  8. Rank 8

    SAP NetWeaverCVE-2025-42999

    SAP NetWeaver Deserialization Vulnerability

    Ransomware

    CVSS severity 9.1critical

    Added May 15, 2025

  9. Rank 9

    SAP NetWeaverCVE-2021-38163

    SAP NetWeaver Unrestricted File Upload Vulnerability

    CVSS severity 8.8high

    Added Jun 9, 2022

  10. Rank 10

    SAP NetWeaverCVE-2017-12637

    SAP NetWeaver Directory Traversal Vulnerability

    CVE from 2017, added in 2025

    CVSS severity 7.5high

    Added Mar 19, 2025

Show 4 more vulnerabilities
  1. Rank 11

    SAP NetWeaverCVE-2016-3976

    SAP NetWeaver Directory Traversal Vulnerability

    CVE from 2016, added in 2021

    CVSS severity 7.5high

    Added Nov 3, 2021

  2. Rank 12

    SAP CRMCVE-2018-2380

    SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

    RansomwareCVE from 2018, added in 2021

    CVSS severity 6.6medium

    Added Nov 3, 2021

  3. Rank 13

    SAP NetWeaverCVE-2016-9563

    SAP NetWeaver XML External Entity (XXE) Vulnerability

    CVE from 2016, added in 2021

    CVSS severity 6.5medium

    Added Nov 3, 2021

  4. Rank 14

    SAP NetWeaverCVE-2016-2388

    SAP NetWeaver Information Disclosure Vulnerability

    CVE from 2016, added in 2022

    CVSS severity 5.3medium

    Added Jun 9, 2022

Follow and verify

Get new SAP vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.