SAP flaws being used in attacks
CISA lists 14 flaws in SAP products as being used in attacks, most recently on 15 May 2025. 3 have been used in ransomware.
SAPBeing used in attacks
- On CISA’s list
- 14 flaws, added between 3 Nov 2021 and 15 May 2025
- Most recent
- CVE-2025-42999, SAP NetWeaver Deserialization Vulnerability, added 15 May 2025
- Used in ransomware
- 3 flaws, according to CISA
- Products
- NetWeaver (10), Commerce Cloud (1), Customer Relationship Management (CRM) (1), Multiple Products (1), Solution Manager (1)
What to do
- Update every SAP product you use.Install the updates SAP offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- SAP NetWeaver
CVE-2025-42999SAP NetWeaver Deserialization VulnerabilitySAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - SAP NetWeaver
CVE-2025-31324SAP NetWeaver Unrestricted File Upload VulnerabilitySAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - SAP NetWeaver
CVE-2017-12637SAP NetWeaver Directory Traversal VulnerabilitySAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - SAP Commerce Cloud
CVE-2019-0344SAP Commerce Cloud Deserialization of Untrusted Data VulnerabilitySAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - SAP Multiple Products
CVE-2022-22536SAP Multiple Products HTTP Request Smuggling VulnerabilitySAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.CISA’s required actionApply updates per vendor instructions. - SAP NetWeaver
CVE-2021-38163SAP NetWeaver Unrestricted File Upload VulnerabilitySAP NetWeaver contains a vulnerability that allows unrestricted file upload.CISA’s required actionApply updates per vendor instructions. - SAP NetWeaver
CVE-2016-2388SAP NetWeaver Information Disclosure VulnerabilityThe Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.CISA’s required actionApply updates per vendor instructions. - SAP NetWeaver
CVE-2016-2386SAP NetWeaver SQL Injection VulnerabilitySQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CISA’s required actionApply updates per vendor instructions. - SAP NetWeaver
CVE-2020-6287SAP NetWeaver Missing Authentication for Critical Function VulnerabilitySAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.CISA’s required actionApply updates per vendor instructions. - SAP Solution Manager
CVE-2020-6207SAP Solution Manager Missing Authentication for Critical Function VulnerabilitySAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.CISA’s required actionApply updates per vendor instructions. - SAP Customer Relationship Management (CRM)
CVE-2018-2380SAP Customer Relationship Management (CRM) Path Traversal VulnerabilitySAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.CISA’s required actionApply updates per vendor instructions. - SAP NetWeaver
CVE-2016-9563SAP NetWeaver XML External Entity (XXE) VulnerabilitySAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.CISA’s required actionApply updates per vendor instructions. - SAP NetWeaver
CVE-2016-3976SAP NetWeaver Directory Traversal VulnerabilitySAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.CISA’s required actionApply updates per vendor instructions. - SAP NetWeaver
CVE-2010-5326SAP NetWeaver Remote Code Execution VulnerabilitySAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. SAP on CISA’s site.