Brand

SAP: actively exploited vulnerabilities

14 vulnerabilities in SAP products (NetWeaver, Commerce Cloud (Hybris), CRM…) are in CISA’s catalog of exploited vulnerabilities. Last added: May 15, 2025.

SAP security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

0 vulnerabilities added in the last 12 months
14 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

By category

Add just one SAP category to your radar, or open its page.

ERP, business applications and databases 13 vulnerabilities
CMS, e-commerce and websites 1 vulnerability

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

NetWeaver 11 vulnerabilities · Business apps and data
Commerce Cloud (Hybris) 1 vulnerability · CMS and websites
CRM 1 vulnerability · Business apps and data
Solution Manager 1 vulnerability · Business apps and data

Name used by CISA: SAP. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this SAP list.

Rank 1SAP NetWeaver
CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
Added more than a year ago: ranked by severity.
Added
Aug 18, 2022
CISA deadline
21 days
CVSS severity
10.0 (critical)
Rank 2SAP NetWeaver
CVE-2010-5326
CVE from 2010, added in 2021
SAP NetWeaver Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
10.0 (critical)
Rank 3SAP NetWeaver
CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
10.0 (critical)
Rank 4SAP NetWeaver
CVE-2025-31324
Ransomware
SAP NetWeaver Unrestricted File Upload Vulnerability
Added more than a year ago: ranked by severity.
Added
Apr 29, 2025
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 5SAP Commerce Cloud (Hybris)
CVE-2019-0344
CVE from 2019, added in 2024
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
Added more than a year ago: ranked by severity.
Added
Sep 30, 2024
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 6SAP NetWeaver
CVE-2016-2386
CVE from 2016, added in 2022
SAP NetWeaver SQL Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 9, 2022
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 7SAP Solution Manager
CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
9.8 (critical)
Rank 8SAP NetWeaver
CVE-2025-42999
Ransomware
SAP NetWeaver Deserialization Vulnerability
Added more than a year ago: ranked by severity.
Added
May 15, 2025
CISA deadline
21 days
CVSS severity
9.1 (critical)
Rank 9SAP NetWeaver
CVE-2021-38163
SAP NetWeaver Unrestricted File Upload Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 9, 2022
CISA deadline
21 days
CVSS severity
8.8 (high)
Rank 10SAP NetWeaver
CVE-2017-12637
CVE from 2017, added in 2025
SAP NetWeaver Directory Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Mar 19, 2025
CISA deadline
21 days
CVSS severity
7.5 (high)

Show 4 more vulnerabilities

Rank 11SAP NetWeaver
CVE-2016-3976
CVE from 2016, added in 2021
SAP NetWeaver Directory Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
7.5 (high)
Rank 12SAP CRM
CVE-2018-2380
RansomwareCVE from 2018, added in 2021
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
6.6 (medium)
Rank 13SAP NetWeaver
CVE-2016-9563
CVE from 2016, added in 2021
SAP NetWeaver XML External Entity (XXE) Vulnerability
Added more than a year ago: ranked by severity.
Added
Nov 3, 2021
CISA deadline
181 days
CVSS severity
6.5 (medium)
Rank 14SAP NetWeaver
CVE-2016-2388
CVE from 2016, added in 2022
SAP NetWeaver Information Disclosure Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 9, 2022
CISA deadline
21 days
CVSS severity
5.3 (medium)

Get new SAP vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.

By category

Affected products

Patch first

Follow and verify