Exploited vulnerabilities (CISA KEV)

CVE-2025-42999 Critical · 9.1 KEV High · 69 Ransomware CWE-502 May 12, 2025

SAP NetWeaver Deserialization Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

CVE-2025-31324 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-434 Apr 24, 2025

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

CVE-2022-22536 Critical · 10.0 KEV Urgent · 81 Public exploit CWE-444 Feb 9, 2022

SAP Multiple Products HTTP Request Smuggling Vulnerability

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

CVE-2021-38163 High · 8.8 KEV High · 62 Public exploit CWE-22 Sep 14, 2021

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.

CVE-2020-6287 Critical · 10.0 KEV Urgent · 83 Public exploit CWE-306 Jul 14, 2020

SAP NetWeaver Missing Authentication for Critical Function Vulnerability

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

CVE-2020-6207 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-306 Mar 10, 2020

SAP Solution Manager Missing Authentication for Critical Function Vulnerability

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

CVE-2019-0344 Critical · 9.8 KEV High · 62 CWE-502 Aug 14, 2019

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.

CVE-2018-2380 Medium · 6.6 KEV Urgent · 77 Public exploit Ransomware CWE-22 Mar 1, 2018

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

CVE-2017-12637 High · 7.5 KEV High · 69 Public exploit CWE-22 Aug 7, 2017

SAP NetWeaver Directory Traversal Vulnerability

Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.

CVE-2016-9563 Medium · 6.5 KEV High · 53 CWE-611 Nov 23, 2016

SAP NetWeaver XML External Entity (XXE) Vulnerability

BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.

CVE-2010-5326 Critical · 10.0 KEV Urgent · 73 CWE-306 May 13, 2016

SAP NetWeaver Remote Code Execution Vulnerability

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

CVE-2016-3976 High · 7.5 KEV High · 67 Public exploit CWE-22 Apr 7, 2016

SAP NetWeaver Directory Traversal Vulnerability

Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.

CVE-2016-2388 Medium · 5.3 KEV High · 64 Public exploit CWE-200 Feb 16, 2016

SAP NetWeaver Information Disclosure Vulnerability

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

CVE-2016-2386 Critical · 9.8 KEV Urgent · 77 Public exploit CWE-89 Feb 16, 2016

SAP NetWeaver SQL Injection Vulnerability

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.