SAP SE vulnerabilities

Published CVEs affecting SAP SE products: 250 record(s), with severity, exploitation and fixes.

Approuter 13 Netweaver Application Server Abap 13 SAP Business AI Platform (Approuter) 11 Netweaver Application Server Java 10 Businessobjects Business Intelligence Platform 9 SAP NetWeaver Application Server for ABAP 7 SAP NetWeaver Enterprise Portal 7 SAP Manufacturing Integration and Intelligence 7 SAP Fiori App (Intercompany Balance Reconciliation) 6 Commerce Cloud 5 Business Connector 5 SAP NetWeaver AS ABAP and ABAP Platform 5 Netweaver 4 SAP NetWeaver and ABAP Platform 3 Solution Manager 3 Sap Basis 3 Solution Tools Plug-in 3 S/4hana 3 S4core 3 SAP S/4HANA (Finance for Advanced Payment Management) 3 SAP NetWeaver Application Server ABAP and ABAP Platform 3 SAP NetWeaver (Visual Composer development server) 2 SAP BusinessObjects Business Intelligence Platform (AdminTools) 2 Document Management System 2 Erp 2 Netweaver As Abap Kernel 2 Netweaver As Abap Krnl64nuc 2 Netweaver As Abap Krnl64uc 2 Supply Chain Management 2 SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) 2 SAP Fiori (launchpad) 2 SAP Supplier Relationship Management (SICF Handler in SRM Catalog) 2 Supplier Relationship Management 2 SAP NetWeaver Application Server for ABAP and ABAP Platform 2 SAP Web Dispatcher, Internet Communication Manager and SAP Content Server 2 SAP Solution Tools Plug-In (ST-PI) 2 SAP Landscape Transformation 2 SAPUI5 2 SAP ABAP Platform 2 SAP BusinessObjects BI Platform 2

Exploited only (KEV) →

CVE-2026-24315 Medium · 4.2 CWE-35 Jun 8, 2026

Path Traversal Vulnerability in SAP Fiori (launchpad)

SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.

CVE-2026-44749 Medium · 4.3 CWE-497 May 26, 2026

Information Disclosure vulnerability in SAP Gateway

The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.

CVE-2026-27680 Medium · 4.3 CWE-276 May 14, 2026

CSS Injection vulnerability in SAP NetWeaver Application Server ABAP

Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.

CVE-2026-40137 Medium · 6.1 CWE-79 May 12, 2026

Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)

SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.

CVE-2026-40136 Medium · 4.3 CWE-404 May 12, 2026

Denial of service (DoS) in SAP Financial Consolidation

SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access. However, the application itself cannot be compromised resulting in a low impact on availability. There is no impact on confidentiality and integrity of the data

CVE-2026-40135 Medium · 6.5 CWE-77 May 12, 2026

OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.

CVE-2026-40134 Medium · 4.3 CWE-862 May 12, 2026

Missing Authorization Check in SAP Incentive and Commission Management

Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform table update operations. This vulnerability has a low impact on integrity with no impact on confidentiality and availability of the application.

CVE-2026-40133 Medium · 6.3 CWE-862 May 12, 2026

Missing Authorization check in SAP S/4HANA Condition Maintenance

Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table records, resulting in low impact on the confidentiality and integrity of the data. Additionally, this vulnerability may prevent the legitimate user from accessing the records, causing low impact on application availability.

CVE-2026-40132 Medium · 5.4 CWE-862 May 12, 2026

Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This vulnerability also enables the attacker to change the default settings and modify value fields, which will mislead risk evaluations and falsely lower assessed risk levels. This results in a low impact on the confidentiality and integrity of the data. There is no impact on the application�s availability.

CVE-2026-40131 Low · 3.4 CWE-89 May 12, 2026

SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library

SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepared statements. Successful exploitation could allow the high privileged users to alter the SELECT statements impacting confidentiality and availability of the application. There is no impact on integrity.

CVE-2026-40129 Medium · 4.3 CWE-94 May 12, 2026

Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform

Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafted inputs to the application. If processed by the application, this input could be delivered to users subscribed to the channel and result in execution. Successful exploitation could enable the attacker to execute arbitrary code for other users, resulting in a low impact on the integrity, with no impact to the confidentiality and availability of the system.

CVE-2026-34263 Critical · 9.6 CWE-459 May 12, 2026

SAP Commerce Cloud Spring Security Misconfiguration Leading to Code Injection

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of the application.

CVE-2026-34260 Critical · 9.6 CWE-89 May 12, 2026

SAP S/4HANA SQL Injection (CWE-89) in Enterprise Search for ABAP

SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization. Upon successful exploitation, an attacker may gain unauthorized access to sensitive database information and could potentially crash the application. This vulnerability has a high impact on the confidentiality and availability of the application, while integrity remains unaffected.

CVE-2026-34259 High · 8.2 CWE-77 May 12, 2026

OS Command Injection Vulnerability in SAP Forecasting & Replenishment

Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system, resulting in a complete compromise of confidentiality, integrity, and availability.

CVE-2026-34258 Medium · 4.7 CWE-451 May 12, 2026

Content Spoofing vulnerability in SAPUI5 (Search UI)

SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on the integrity and availability of the application.

CVE-2026-27682 Medium · 6.1 CWE-79 May 12, 2026

Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages)

Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthenticated attacker could craft a URL that exploits an unprotected URL parameter to embed a malicious script. If a victim clicks the link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access and/or modify information, impacting the confidentiality and integrity of the application, with no impact to availability.

CVE-2026-0502 Medium · 5.4 CWE-352 May 12, 2026

Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform

Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an attacker to send unintended requests to the web server. This has low impact on integrity and availability of the application. There is no impact on confidentiality of the data.

CVE-2026-34264 Medium · 6.5 CWE-204 Apr 13, 2026

Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.

CVE-2026-34262 Medium · 4.3 CWE-522 Apr 13, 2026

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

CVE-2026-34261 Medium · 6.5 CWE-862 Apr 13, 2026

Missing Authorization check in SAP Business Analytics and SAP Content Management

Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.

CVE-2026-34257 Medium · 6.1 CWE-601 Apr 13, 2026

Open Redirect vulnerability in SAP NetWeaver Application Server ABAP

Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability.

CVE-2026-34256 High · 7.1 CWE-862 Apr 13, 2026

Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)

Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable. Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.

CVE-2026-27683 Medium · 4.1 CWE-79 Apr 13, 2026

Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs. When a victim accesses the URL, the script executes in the user�s browser, potentially exposing restricted information. This results in a low impact on confidentiality with no impact on integrity and availability.

CVE-2026-27681 Critical · 9.9 CWE-89 Apr 13, 2026

SAP BPC and SAP BW SQL Injection via Authorization Flaw (CVE-2026-27681)

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiality, integrity, and availability of the system.

CVE-2026-27679 Medium · 6.5 CWE-862 Apr 13, 2026

Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures)

Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This vulnerability has a high impact on integrity, while confidentiality and availability are not impacted.