Vulnerabilidades do SAP SE Netweaver
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam SAP SE Netweaver: 4 registro(s), com versões afetadas e correções.cpe:2.3:a:sap:netweaver
CVE-2026-23685
Média · 4.4
CWE-502 10/02/2026
Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)
Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.
CVE-2025-42999
Crítica · 9.1
KEV Alta · 69 Ransomware CWE-502 12/05/2025
SAP NetWeaver Deserialization Vulnerability
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
CVE-2025-31324
Crítica · 9.8
KEV Urgente · 83 Exploit público Ransomware CWE-434 24/04/2025
SAP NetWeaver Unrestricted File Upload Vulnerability
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CVE-2021-38163
Alta · 8.8
KEV Alta · 62 Exploit público CWE-22 14/09/2021
SAP NetWeaver Unrestricted File Upload Vulnerability
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.