SAP: exploited vulnerabilities
- 14exploited vulnerabilities
- 3used by ransomware
- May 15, 2025latest one added
- NetWeaver 10
- Commerce Cloud 1
- Multiple Products 1
- Solution Manager 1
- Customer Relationship Management (CRM) 1
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 15, 2025 | Deserialization | NetWeaver | Critical 9.1 | 13% |
| Apr 29, 2025 | Unrestricted File Upload | NetWeaver | Critical 10.0 | 99.5% |
| Mar 19, 2025 | Directory Traversal | NetWeaver | High 7.5 | 95% |
| Sep 30, 2024 | Deserialization of Untrusted Data | Commerce Cloud | Critical 9.8 | 7.5% |
| Aug 18, 2022 | HTTP Request Smuggling | Multiple Products | Critical 9.8 | 98% |
| Jun 9, 2022 | Unrestricted File Upload | NetWeaver | Critical 9.9 | 37% |
| Jun 9, 2022 | Information Disclosure | NetWeaver | Medium 5.3 | 52% |
| Jun 9, 2022 | SQL Injection | NetWeaver | Critical 9.8 | 72% |
| Nov 3, 2021 | Missing Authentication for Critical Function | NetWeaver | Critical 10.0 | 95% |
| Nov 3, 2021 | Missing Authentication for Critical Function | Solution Manager | Critical 10.0 | 98% |
| Nov 3, 2021 | Path Traversal | Customer Relationship Management (CRM) | Medium 6.6 | 29% |
| Nov 3, 2021 | XML External Entity (XXE) | NetWeaver | Medium 6.5 | 24% |
| Nov 3, 2021 | Directory Traversal | NetWeaver | High 7.5 | 47% |
| Nov 3, 2021 | Remote Code Execution | NetWeaver | Critical 10.0 | 18% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.