Vulnerabilidades de SAP SE

CVEs publicadas que afetam produtos de SAP SE: 250 registro(s), com severidade, exploração e correções.

Approuter 13 Netweaver Application Server Abap 13 SAP Business AI Platform (Approuter) 11 Netweaver Application Server Java 10 Businessobjects Business Intelligence Platform 9 SAP NetWeaver Application Server for ABAP 7 SAP NetWeaver Enterprise Portal 7 SAP Manufacturing Integration and Intelligence 7 SAP Fiori App (Intercompany Balance Reconciliation) 6 Commerce Cloud 5 Business Connector 5 SAP NetWeaver AS ABAP and ABAP Platform 5 Netweaver 4 SAP NetWeaver and ABAP Platform 3 Solution Manager 3 Sap Basis 3 Solution Tools Plug-in 3 S/4hana 3 S4core 3 SAP S/4HANA (Finance for Advanced Payment Management) 3 SAP NetWeaver Application Server ABAP and ABAP Platform 3 SAP NetWeaver (Visual Composer development server) 2 SAP BusinessObjects Business Intelligence Platform (AdminTools) 2 Document Management System 2 Erp 2 Netweaver As Abap Kernel 2 Netweaver As Abap Krnl64nuc 2 Netweaver As Abap Krnl64uc 2 Supply Chain Management 2 SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) 2 SAP Fiori (launchpad) 2 SAP Supplier Relationship Management (SICF Handler in SRM Catalog) 2 Supplier Relationship Management 2 SAP NetWeaver Application Server for ABAP and ABAP Platform 2 SAP Web Dispatcher, Internet Communication Manager and SAP Content Server 2 SAP Solution Tools Plug-In (ST-PI) 2 SAP Landscape Transformation 2 SAPUI5 2 SAP ABAP Platform 2 SAP BusinessObjects BI Platform 2

Somente exploradas (KEV) →

CVE-2026-24315 Média · 4.2 CWE-35 08/06/2026

Path Traversal Vulnerability in SAP Fiori (launchpad)

SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.

CVE-2026-44749 Média · 4.3 CWE-497 26/05/2026

Information Disclosure vulnerability in SAP Gateway

The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.

CVE-2026-27680 Média · 4.3 CWE-276 14/05/2026

CSS Injection vulnerability in SAP NetWeaver Application Server ABAP

Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.

CVE-2026-40137 Média · 6.1 CWE-79 12/05/2026

Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)

SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.

CVE-2026-40136 Média · 4.3 CWE-404 12/05/2026

Denial of service (DoS) in SAP Financial Consolidation

SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access. However, the application itself cannot be compromised resulting in a low impact on availability. There is no impact on confidentiality and integrity of the data

CVE-2026-40135 Média · 6.5 CWE-77 12/05/2026

OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.

CVE-2026-40134 Média · 4.3 CWE-862 12/05/2026

Missing Authorization Check in SAP Incentive and Commission Management

Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module to perform table update operations. This vulnerability has a low impact on integrity with no impact on confidentiality and availability of the application.

CVE-2026-40133 Média · 6.3 CWE-862 12/05/2026

Missing Authorization check in SAP S/4HANA Condition Maintenance

Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table records, resulting in low impact on the confidentiality and integrity of the data. Additionally, this vulnerability may prevent the legitimate user from accessing the records, causing low impact on application availability.

CVE-2026-40132 Média · 5.4 CWE-862 12/05/2026

Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access information that they are otherwise unauthorized to view. This vulnerability also enables the attacker to change the default settings and modify value fields, which will mislead risk evaluations and falsely lower assessed risk levels. This results in a low impact on the confidentiality and integrity of the data. There is no impact on the application�s availability.

CVE-2026-40131 Baixa · 3.4 CWE-89 12/05/2026

SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library

SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepared statements. Successful exploitation could allow the high privileged users to alter the SELECT statements impacting confidentiality and availability of the application. There is no impact on integrity.

CVE-2026-40129 Média · 4.3 CWE-94 12/05/2026

Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform

Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafted inputs to the application. If processed by the application, this input could be delivered to users subscribed to the channel and result in execution. Successful exploitation could enable the attacker to execute arbitrary code for other users, resulting in a low impact on the integrity, with no impact to the confidentiality and availability of the system.

CVE-2026-34263 Crítica · 9.6 CWE-459 12/05/2026

SAP Commerce Cloud: configuração incorreta do Spring Security permite injeção de entrada e execução de código

Devido a uma configuração inadequada do Spring Security, o SAP Commerce Cloud permite que um usuário não autenticado realize injeção de entrada maliciosa, resultando em execução arbitrária de código no lado do servidor, o que leva a alto impacto na Confidencialidade, Integridade e Disponibilidade da aplicação.

CVE-2026-34260 Crítica · 9.6 CWE-89 12/05/2026

Injeção de SQL (CWE-89) no SAP S/4HANA em Enterprise Search for ABAP

O SAP S/4HANA (SAP Enterprise Search for ABAP) contém uma vulnerabilidade de injeção de SQL que permite a um invasor autenticado injetar instruções SQL maliciosas por meio de entrada controlada pelo usuário. A aplicação concatena diretamente essa entrada maliciosa em consultas SQL, que são então repassadas ao banco de dados subjacente sem validação ou sanitização adequadas. Após a exploração bem-sucedida, um invasor pode obter acesso não autorizado a informações sensíveis do banco de dados e pode potencialmente travar a aplicação. Esta vulnerabilidade tem alto impacto na confidencialidade e na disponibilidade da aplicação, enquanto a integridade permanece não afetada.

CVE-2026-34259 Alta · 8.2 CWE-77 12/05/2026

OS Command Injection Vulnerability in SAP Forecasting & Replenishment

Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation could allow the attacker to read or modify any system data or shut down the system, resulting in a complete compromise of confidentiality, integrity, and availability.

CVE-2026-34258 Média · 4.7 CWE-451 12/05/2026

Content Spoofing vulnerability in SAPUI5 (Search UI)

SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on the integrity and availability of the application.

CVE-2026-27682 Média · 6.1 CWE-79 12/05/2026

Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages)

Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthenticated attacker could craft a URL that exploits an unprotected URL parameter to embed a malicious script. If a victim clicks the link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access and/or modify information, impacting the confidentiality and integrity of the application, with no impact to availability.

CVE-2026-0502 Média · 5.4 CWE-352 12/05/2026

Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform

Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could be tricked by an attacker to send unintended requests to the web server. This has low impact on integrity and availability of the application. There is no impact on confidentiality of the data.

CVE-2026-34264 Média · 6.5 CWE-204 13/04/2026

Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA

During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low privileges could guess and enumerate the content shown, beyond their authorized scope. This leads to disclosure of sensitive information causing a high impact on confidentiality, while integrity and availability are unaffected.

CVE-2026-34262 Média · 4.3 CWE-522 13/04/2026

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

CVE-2026-34261 Média · 6.5 CWE-862 13/04/2026

Missing Authorization check in SAP Business Analytics and SAP Content Management

Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote function modules, potentially accessing sensitive information beyond their intended permissions. This vulnerability affects confidentiality, with no impact on integrity and availability.

CVE-2026-34257 Média · 6.1 CWE-601 13/04/2026

Open Redirect vulnerability in SAP NetWeaver Application Server ABAP

Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability.

CVE-2026-34256 Alta · 7.1 CWE-862 13/04/2026

Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)

Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable. Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.

CVE-2026-27683 Média · 4.1 CWE-79 13/04/2026

Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform

SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs. When a victim accesses the URL, the script executes in the user�s browser, potentially exposing restricted information. This results in a low impact on confidentiality with no impact on integrity and availability.

CVE-2026-27681 Crítica · 9.9 CWE-89 13/04/2026

Injeção de SQL no SAP BPC e SAP BW por Falha de Autorização (CVE-2026-27681)

Devido a verificações de autorização insuficientes no SAP Business Planning and Consolidation e no SAP Business Warehouse, um usuário autenticado pode executar instruções SQL elaboradas para ler, modificar e excluir dados do banco de dados. Isso leva a um alto impacto na confidencialidade, integridade e disponibilidade do sistema.

CVE-2026-27679 Média · 6.5 CWE-862 13/04/2026

Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures)

Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exposed OData services without proper authorization. This vulnerability has a high impact on integrity, while confidentiality and availability are not impacted.