CVE Intelligence

SAP SE Netweaver vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting SAP SE Netweaver: 4 record(s), with affected versions and fixes.
cpe:2.3:a:sap:netweaver

CVE-2026-23685 Medium · 4.4 CWE-502 Feb 10, 2026
Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)
Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.
CVE-2025-42999 Critical · 9.1 KEV High · 69 Ransomware CWE-502 May 12, 2025
SAP NetWeaver Deserialization Vulnerability
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
CVE-2025-31324 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-434 Apr 24, 2025
SAP NetWeaver Unrestricted File Upload Vulnerability
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CVE-2021-38163 High · 8.8 KEV High · 62 Public exploit CWE-22 Sep 14, 2021
SAP NetWeaver Unrestricted File Upload Vulnerability
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.