By year
01
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
25
Bars are flaws published each year; the red part is the share attackers have used.
Exploited SAP flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2025-42999 SAP NetWeaver DeserializationExploited since May 15, 2025 · ransomware · CVSS 9.1
- CVE-2025-31324 SAP NetWeaver Unrestricted File UploadExploited since Apr 29, 2025 · ransomware · CVSS 10
- CVE-2017-12637 SAP NetWeaver Directory TraversalExploited since Mar 19, 2025 · CVSS 7.5
- CVE-2019-0344 SAP Commerce Cloud Deserialization of Untrusted DataExploited since Sep 30, 2024 · CVSS 9.8
- CVE-2022-22536 SAP Multiple Products HTTP Request SmugglingExploited since Aug 18, 2022 · CVSS 10
- CVE-2016-2386 SAP NetWeaver SQL InjectionExploited since Jun 9, 2022 · CVSS 9.8
- CVE-2021-38163 SAP NetWeaver Unrestricted File UploadExploited since Jun 9, 2022 · CVSS 9.9
- CVE-2016-2388 SAP NetWeaver Information DisclosureExploited since Jun 9, 2022 · CVSS 5.3
- CVE-2020-6207 SAP Solution Manager Missing Authentication for Critical FunctionExploited since Nov 3, 2021 · CVSS 9.8
- CVE-2016-9563 SAP NetWeaver XML External Entity (XXE)Exploited since Nov 3, 2021 · CVSS 6.5
- CVE-2010-5326 SAP NetWeaver Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 10
- CVE-2016-3976 SAP NetWeaver Directory TraversalExploited since Nov 3, 2021 · CVSS 7.5
- CVE-2020-6287 SAP NetWeaver Missing Authentication for Critical FunctionExploited since Nov 3, 2021 · CVSS 10
- CVE-2018-2380 SAP Customer Relationship Management (CRM) Path TraversalExploited since Nov 3, 2021 · ransomware · CVSS 6.6
Latest high and critical flaws
- CVE-2025-42999 SAP NetWeaver DeserializationExploited · Critical 9.1 · May 12, 2025
- CVE-2025-31324 SAP NetWeaver Unrestricted File UploadExploited · Critical 10 · Apr 24, 2025
- CVE-2023-29186 In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on High 8.7 · Apr 11, 2023
- CVE-2023-28765 An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar fiCritical 9.8 · Apr 10, 2023
- CVE-2023-27497 Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute Critical 10 · Apr 10, 2023
- CVE-2023-27267 Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowlCritical 9 · Apr 10, 2023
- CVE-2023-27893 An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems High 8.8 · Mar 14, 2023
- CVE-2023-27501 SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufHigh 8.7 · Mar 14, 2023
- CVE-2023-27500 An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files.Critical 9.6 · Mar 14, 2023
- CVE-2023-27498 SAP Host Agent (SAPOSCOL) - version 7.22, allows an unauthenticated attacker with network access to a server port assigned to the SAP Start Service to submit a High 7.2 · Mar 14, 2023
- CVE-2023-27269 SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker Critical 9.6 · Mar 14, 2023
- CVE-2023-26459 Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, aHigh 7.4 · Mar 14, 2023
- CVE-2023-25617 SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled,Critical 9 · Mar 14, 2023
- CVE-2023-25616 In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerabiliCritical 9.9 · Mar 14, 2023
- CVE-2023-23857 Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use ofCritical 9.9 · Mar 14, 2023
- CVE-2023-24530 SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed bHigh 8.4 · Feb 13, 2023
- CVE-2023-24523 An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submiHigh 8.8 · Feb 13, 2023
- CVE-2023-0022 SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the applicCritical 9.9 · Jan 9, 2023
- CVE-2023-0018 Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an atCritical 10 · Jan 9, 2023
- CVE-2023-0017 An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an openCritical 9.4 · Jan 9, 2023
- CVE-2023-0016 SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries.Critical 9.9 · Jan 9, 2023
- CVE-2023-0014 SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.Critical 9 · Jan 9, 2023
- CVE-2022-41272 An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process InteCritical 9.9 · Dec 12, 2022
- CVE-2022-41271 An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50.Critical 9.4 · Dec 12, 2022
- CVE-2022-41268 In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, aHigh 8.5 · Dec 12, 2022
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.