SAP

Regular Expression Denial of Service in SAP S/4HANA (Private Cloud) allows unauthenticated remote attackers to exhaust server resources by supplying specially crafted input to a network-accessible endpoint that invokes a vulnerable third-party regex component (CWE-1333). Successful exploitation causes high availability impact with no confidentiality or integrity exposure, making this a targeted disruption risk against a critical ERP platform. No active exploitation has been confirmed - the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc_ui_autobind() llc_ui_autobind() opens a SAP after choosing a dynamic LSAP. llc_sap_open() returns a reference owned by the caller, and llc_sap_add_socket() takes a second reference for the socket's membership in the SAP hash tables. llc_ui_bind() drops the caller's reference after adding the socket, but llc_ui_autobind() keeps it. When the socket is closed, llc_sap_remove_socket() releases only the socket reference, leaving the SAP on llc_sap_list with sk_count == 0. This is user-visible because repeated autobind and close cycles can consume all dynamic SAP values and make later autobinds fail with -EUSERS. Drop the caller's reference after a successful autobind, matching llc_ui_bind()'s ownership model.

Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.

DOM-based reflected Cross-Site Scripting in SAP NetWeaver Application Server ABAP enables an authenticated attacker to craft a malicious URL and distribute it to other authenticated SAP users. When a victim accesses the link, unsanitized input is reflected and executed within the DOM in the victim's browser, resulting in high confidentiality impact - such as session token or credential theft - and low integrity impact. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the high confidentiality component.

Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attackers to send specially crafted requests that bypass header sanitization, resulting in limited unauthorized information disclosure from internal backend components. All SAP Approuter Node.js package versions below 23.0.0 are affected, with a vendor-released patch available at version 23.0.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the zero-authentication requirement and low attack complexity make it accessible to opportunistic actors targeting exposed SAP BTP deployments.

Path traversal authorization bypass in SAP Approuter (Node.js package, versions prior to 23.0.0) enables a low-privileged authenticated attacker to send specially crafted requests that escape the Approuter's routing authorization controls and reach protected backend destinations beyond their assigned scope. Successful exploitation yields high confidentiality impact - exposure of sensitive backend data - and limited integrity impact through restricted modifications to protected resources, with no effect on availability. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by high attack complexity per the CVSS AC:H rating.

Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privilege attacker to hijack another user's session by sending crafted requests that circumvent header integrity verification on certain code paths. Exploitation demands prior out-of-band observation of the target's session values, constraining this to determined, targeted attackers rather than opportunistic mass exploitation. No public exploit code and no CISA KEV listing identified at time of analysis, but successful exploitation yields full read access to the victim's session context with a high confidentiality impact per CVSS.

Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.

Improper error condition handling in SAP Approuter (the node.js routing component of SAP Business AI Platform) allows a low-privileged network attacker to cause a partial availability disruption under a non-default configuration. The attack is highly complex, requiring conditions outside the attacker's control, and produces only low availability impact with no confidentiality or integrity loss. No public exploit has been identified at time of analysis, and a vendor patch is available in Approuter node.js package version 23.0.0 and later.

SAP BusinessObjects Business Intelligence Platform (Admin Tools) fails to enforce authorization checks on certain administrative functions, allowing an authenticated low-privilege user to access restricted information. Affected versions include the 2025 release and ENTERPRISE 430. The flaw is classified as CWE-862 (Missing Authorization) and carries a CVSS 4.3 rating with no public exploit identified at time of analysis and no CISA KEV listing.

SQL DDL injection in SAP Social Intelligence (versions 102-109) allows an authenticated low-privilege network attacker to directly execute Data Definition Language commands against the underlying database. Exploitation can alter or destroy database schema objects - a more structurally damaging capability than typical DML injection - with vendor-rated Low impact across confidentiality, integrity, and availability. No active exploitation confirmed at time of analysis and no public exploit identified; patch details are available via SAP Security Note 3766473.

Privilege escalation in SAP S/4HANA's Reprocess Bank Statement Items component allows authenticated users to invoke processing rules that have not been explicitly shared with them, circumventing intended access controls. Affected versions span S4CORE releases 104 through 109, covering a broad swath of actively supported SAP S/4HANA deployments. The impact is confined to low-severity information disclosure - unauthorized rule access reveals restricted bank statement logic - with no integrity or availability consequences; no public exploit or active exploitation has been identified at the time of analysis.

SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. No public exploit or active exploitation has been identified at time of analysis, but the CVSS scope change (S:C) signals that successfully decrypted credentials can be used to compromise systems beyond the BI platform itself.

Unbounded memory growth in SAP Business AI Platform (Approuter) allows a low-privileged authenticated attacker to degrade availability by flooding the application with high-volume data while suppressing response consumption. The vulnerability stems from insufficient flow control, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). Confidentiality and integrity are unaffected; the impact is limited to availability, and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Certificate validation bypass in SAP Approuter node.js package (versions prior to 23.0.0) enables a low-privileged network attacker holding a certificate from the same trusted CA with matching subject values to impersonate trusted internal components during certain callback flows. The attack path is constrained by high complexity - the attacker must satisfy specific PKI prerequisites - but successful exploitation yields high integrity impact through component impersonation. No public exploit code or CISA KEV listing has been identified at time of analysis.

XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence (Web Intelligence) enables a low-privileged authenticated attacker to read arbitrary server-side files by uploading a crafted spreadsheet containing malicious external entity references and using it as a report data source. Affected versions span the 2025, 2027, ENTERPRISE 430, and ENTERPRISECLIENTTOOLS 430 release lines, all confirmed by ENISA EUVD-2026-55877 and SAP Note 3753141. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low authentication bar and high confidentiality impact make this a material risk for any enterprise running Web Intelligence.

Memory disclosure in SAP ABAP Platform exposes residual data from previously allocated memory buffers to unauthenticated remote attackers via a specially crafted request to an internal component. Affected deployments include ABAP Platform 7.54, KERNEL 7.53, KRNL64UC 7.53, and 7.77, with the vendor characterizing the leaked data as limited and non-sensitive. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, consistent with the moderate CVSS 5.3 rating reflecting low confidentiality impact with no integrity or availability consequences.

Hardcoded credentials embedded in SAP Advanced Planning and Optimization (Model Mix Planning) source code enable authenticated high-privilege attackers to bypass the application's authorization layer and delete specific planning-related restrictions. Confirmed by SAP via Security Note 3763028 and disclosed on SAP Security Patch Day, the flaw spans a wide range of APO versions including SCM 700, S4CORE, and S4COREOP release lines. No public exploit code exists and the vulnerability is not listed in CISA KEV; real-world impact is constrained by the high-privilege prerequisite and limited to low-severity confidentiality and integrity effects.

Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows any low-privileged authenticated user to access user account information that is intended to be restricted to privileged roles. The exposed account data - names, identifiers, or contact details of privileged users - can directly enable targeted follow-on attacks such as spear phishing or credential stuffing against identified administrator accounts. No public exploit code or active exploitation has been identified at time of analysis; CVSS 3.1 rates this Medium (4.3) with low confidentiality impact and no integrity or availability impact.

Missing authorization checks in SAP ABAP Developer Tools (the Eclipse-based IDE for ABAP development) allow any low-privileged SAP user to execute unauthorized database operations against SAP NetWeaver AS ABAP backends. The flaw spans a wide range of SAP_BASIS releases (750 through 920) and yields full confidentiality, integrity, and availability compromise of the ABAP application layer - including the ability to read sensitive business data, modify application records, and disrupt legitimate user access. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage elevate real-world risk considerably for enterprises running ADT-connected NetWeaver systems.

Unauthorized configuration table modification in SAP NetWeaver and ABAP Platform's Change and Transport System (CTS) Customer Transport Integration Wizard allows a low-privileged authenticated user to alter access controls for data objects during specific wizard operations. Affected SAP_BASIS releases span from 740 through 816, covering a broad range of enterprise SAP landscapes. The practical impact is limited to processing delays and operational disruption (low integrity and availability), with no confidentiality exposure; no public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog.

Tenant context spoofing in SAP Approuter (node.js package < 23.0.0) allows unauthenticated remote attackers to craft requests that bypass tenant isolation, resulting in limited cross-tenant information disclosure. Exploitation is constrained by High Attack Complexity (AC:H per vendor CVSS), meaning conditions necessary for success are not fully under attacker control. No public exploit has been identified at time of analysis and a vendor patch is available, making this a low-urgency but compliance-relevant issue for SAP BTP multi-tenant deployments.

Denial-of-service in SAP Approuter (SAP Business AI Platform), the node.js routing and authentication gateway for SAP BTP applications, allows remote unauthenticated attackers to crash and restart the component by sending specially crafted input under specific runtime conditions. All versions of the SAP Approuter node.js package prior to 23.0.0 are affected, with high availability impact and no confidentiality or integrity exposure. No public exploit has been identified at time of analysis, and SAP has released a patch via Security Note 3786038.

Insufficient authorization enforcement in the WebSocket layer of SAP Approuter (node.js package < 23.0.0) allows a low-privileged authenticated attacker to reach functionality that should be access-controlled. Successful exploitation yields high confidentiality impact - exposure of sensitive data routed through the Approuter - and limited data modification capability, with no effect on availability. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available and should be prioritized for SAP BTP environments.

OS command injection in SAP NetWeaver Application Server ABAP and ABAP Platform enables an attacker holding high-privilege credentials to bypass missing security controls on an internal ABAP code path and execute arbitrary commands on the underlying operating system. Affected releases span kernel versions 7.22 through 9.16, placing a broad range of production SAP landscapes at risk of service disruption or unauthorized OS-level writes. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high availability impact (A:H) makes it a meaningful patch priority for SAP Basis teams.

SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.

Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.

Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible due to a missing authorization check on scheduling-related API endpoints. Any network-reachable attacker without credentials can retrieve, create, modify, or delete scheduling data managed by the application, impacting confidentiality, integrity, and availability at a low severity level each. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions - no authentication, no user interaction, low complexity - lower the barrier to opportunistic abuse significantly.

Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend operations to unauthenticated remote attackers via crafted HTTP requests with specific parameter values. Successful exploitation grants read, create, modify, and delete access to application-managed business data, producing a limited but tripartite impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at this time, though the zero-privilege network vector lowers the bar for opportunistic probing.

Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outside intended directory boundaries by supplying specially crafted input to affected file path validation functions. Exploitation requires a legitimate user to subsequently interact with the attacker-influenced content and depends on conditions outside the attacker's direct control, as reflected by the AC:H and UI:R CVSS metrics. Successful exploitation achieves a scope change affecting adjacent components with high impact on confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing exist at time of analysis.

SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.

OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Stack-based buffer overflow in SAP SAPSPrint Service (CWE-121) allows unauthenticated remote attackers to crash the service via specially crafted command requests, triggering an automatic service restart. The impact is limited to low availability disruption with no confidentiality or integrity compromise. No public exploit code or active exploitation has been identified at time of analysis, and SAP has addressed this vulnerability via their Security Patch Day cycle.

Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Information disclosure in SAP NetWeaver AS for ABAP and ABAP Platform allows a privileged user who activates diagnostic tracing to leak session identifiers into trace output. An attacker with access to the trace data can obtain those identifiers and impersonate legitimate users during their validity period. No public exploit or active exploitation has been reported.

Privilege escalation in Checkmk's mk_sap_hana agent plugin allows a local unprivileged user to execute arbitrary commands as root by planting a process whose name mimics a SAP HANA instance. The plugin, when running as root under the RUNAS=agent configuration and lacking explicit database configuration, blindly reads the OS process list to derive SAP HANA instance identifiers and injects them unsanitized into a shell command executed with root privileges - a textbook CWE-78 OS command injection. No public exploit code or CISA KEV listing exists at time of analysis, but the attack prerequisites are achievable on any misconfigured Checkmk deployment that monitors SAP environments.

CSS stylesheet injection in SAP @ui5/webcomponents-base allows unauthenticated remote attackers to load arbitrary cross-origin stylesheets into victim pages by bypassing the sap-allowed-theme-origins allowlist enforcement inside setThemeRoot(). The ?sap-themeRoot URL query parameter is a direct delivery vector, making socially-engineered exploitation trivial - no authentication is required from the attacker (CVSS PR:N), only a victim page load (UI:R). Successful exploitation enables UI redressing, clickjacking, phishing overlays, visual defacement, and limited CSS attribute-selector-based data exfiltration; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Insecure deserialization in the SAP Change and Transport System Attach Tool (ctsattach) lets an authenticated, low-privileged attacker achieve remote code execution by supplying a crafted archive that a victim then processes through the tool's library. Successful exploitation yields high confidentiality and integrity impact - attackers can read sensitive data and take control of the host and its processes - with low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause and 7.6 CVSS make this a meaningful patch priority for SAP landscapes.

Privilege escalation in SAP S/4HANA's Draft Operation component allows authenticated restricted users to read entity data beyond their authorized scope due to missing authorization checks. The flaw, classified under CWE-862, is exploitable over the network without elevated privileges, resulting in low confidentiality impact with no effect on integrity or availability. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk bounded despite the network-accessible attack vector.

Missing authorization in SAP S/4HANA's Create Single Payment function exposes restricted entity set keys to authenticated but low-privileged users. The flaw (CWE-862) allows a restricted user to query specific payment-related entity sets beyond their intended access scope, resulting in low-impact confidentiality leakage with no effect on data integrity or system availability. No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS data was not provided, but the CVSS 4.3 medium score and limited impact scope suggest low exploitation urgency.

SQL injection in SAP S/4HANA Project Management (PPM-PRO) allows a high-privileged authenticated attacker to execute crafted database queries, exposing backend database contents. The vulnerability is reachable over the network but requires both high attack complexity and high privilege level, significantly constraining the realistic attacker pool. No public exploit or active exploitation has been identified at time of analysis, and the CVSS base score of 5.5 reflects these mitigating factors despite the potential for database exposure.

Script injection in SAP CRM WebClient UI is enabled by absent Content Security Policy (CSP) directives for certain restrictive headers, allowing an authenticated low-privileged attacker to inject malicious JavaScript that executes in a victim user's browser session. The CVSS vector (PR:L/UI:R/S:C) confirms this requires both an authenticated attacker and victim interaction, with a cross-scope impact consistent with browser-context script execution. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis, and impact is bounded to low integrity with no confidentiality or availability consequence.

Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed.

Reflected XSS in SAP NetWeaver Application Server ABAP's Business Server Pages (BSP) framework allows remote unauthenticated attackers to inject arbitrary JavaScript into HTTP responses when a victim user interacts with a crafted URL. Successful exploitation enables session token theft and execution of authenticated actions on behalf of the victim within the SAP web context. No public exploit code or CISA KEV listing is identified at time of analysis; CVSS AC:H indicates non-trivial conditions must align for successful delivery, moderating real-world risk despite the enterprise sensitivity of SAP environments.

Reflected cross-site scripting in SAP NetWeaver Enterprise Portal enables unauthenticated remote attackers to inject arbitrary JavaScript into URL parameters that are echoed back unencoded in server responses. When a victim with an active portal session visits a crafted URL, the injected script executes in their browser under the portal's origin, permitting session token theft, unauthorized manipulation of portal content, or forced redirection to attacker-controlled resources. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the unauthenticated network-accessible attack surface and low complexity make phishing-based delivery operationally straightforward.

User account enumeration in SAP HANA Extended Application Services Classic Model (XSC) user self-service tools allows unauthenticated remote attackers to identify valid usernames and email addresses by crafting requests that elicit distinguishable server responses. The CWE-204 root cause - observable response discrepancy - means the application behaves differently for valid versus invalid accounts, leaking account existence without requiring credentials. CVSS scores this at 3.7 (AV:N/AC:H) reflecting network accessibility tempered by high attack complexity; no public exploit code or CISA KEV listing has been identified at time of analysis.

Reflected cross-site scripting in SAP NetWeaver Application Server Java (specifically the Configuration Wizard component) lets an unauthenticated attacker embed malicious JavaScript in crafted URLs that executes in a victim's browser when the link is opened. Because the CVSS scope is changed (S:C) and confidentiality impact is high, a successful lure can expose sensitive session information and tamper with non-sensitive data rendered in the client. No public exploit identified at time of analysis, but the 8.2 CVSS and unauthenticated, network-reachable vector make it a meaningful phishing-driven risk for exposed SAP portals.

Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack.

Unauthorized access in SAP Approuter arises because the component fails to validate incoming request headers during the OAuth2 login flow under certain configurations (CWE-601, open redirect). An unauthenticated remote attacker who lures a victim into clicking a crafted link can hijack the authentication flow to gain high-confidentiality and high-integrity access to the application. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, low-complexity nature (CVSS 8.1) makes it a meaningful patch priority for SAP BTP/Cloud Foundry environments.

Request-response desynchronization in SAP Approuter lets an unauthenticated remote attacker send a specially crafted HTTP request that smuggles a second request past the front end, allowing exposure of other users' HTTP responses and denial of service against the application. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) and was reported by SAP; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Reflected cross-site scripting in SAP Wily Introscope Enterprise Manager allows an unauthenticated remote attacker to craft a malicious URL that, when accessed by a victim user, executes injected JavaScript within the application's browser context. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) confirms network-reachable delivery requiring no attacker credentials, but demands both high attack complexity and victim interaction, capping real-world exploitability. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower-urgency tier despite the cross-scope impact.

Email spoofing in the SAP Business Objects Business Intelligence Platform allows authenticated network users to manipulate email sending parameters without sufficient server-side validation, enabling them to craft and dispatch emails with falsified sender or header fields. Affected users require only low-privilege authentication, and exploitation is network-accessible with no additional user interaction required. No public exploit code exists and this vulnerability is not listed in CISA KEV; the CVSS score of 4.3 (Medium) accurately reflects the limited, integrity-only impact scoped to the application.

Unintended data disclosure in SAP's Operational Data Provisioning RFC (ODP-RFC) modules stems from missing caller identification controls that fail to restrict invocation to permitted SAP-internal applications. Highly privileged customer or third-party applications can invoke these internal RFC modules outside their intended usage context, exposing sensitive operational data across a Changed scope boundary (S:C). No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; however, the High confidentiality impact combined with scope change warrants attention in SAP environments where ODP is exposed to external RFC consumers.

Privilege escalation in SAP MDG's Review Match Groups Application exposes restricted actions to low-privileged authenticated users due to missing authorization checks. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only a valid low-privileged account over the network with no additional interaction, enabling unauthorized data modification. Impact is scoped to low integrity degradation - confidentiality and availability are unaffected - making this a moderate business risk primarily for organizations where MDG data integrity is compliance-critical. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Signed XML message tampering in SAP NetWeaver Application Server ABAP and ABAP Platform allows authenticated low-privileged attackers to forge identity information by capturing a valid signed message and submitting modified signed XML documents that the verifier accepts. The scope-changing flaw (CVSS 9.9) enables unauthorized access to sensitive user data and disruption of normal operations across trust boundaries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Reflected cross-site scripting in SAP NetWeaver JAVA's JDBC Test Servlet enables unauthenticated remote attackers to craft malicious URLs that execute arbitrary JavaScript in a victim's browser upon interaction. The Changed Scope (S:C) in the CVSS vector indicates the injected script can affect browser context beyond the vulnerable origin, enabling session theft, credential harvesting, or unauthorized modification of webclient data. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.

SQL injection in SAP S/4HANA (On-Premise) exposes sensitive ERP database content to authenticated network attackers via a vulnerable remote-enabled function module. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation requiring only a low-privilege SAP user account, with high confidentiality impact and no effect on data integrity or system availability. No public exploit or CISA KEV listing has been identified at time of analysis; SAP has issued a security note addressing the issue.

SAP Business Objects exposes sensitive information through a specific network-accessible endpoint when high-complexity preconditions are met, exploitable by unauthenticated remote attackers. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw carries a CVSS score of 3.7 (Low) with impact limited strictly to partial confidentiality loss - integrity and availability are unaffected. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed.

Path traversal in SAP NetWeaver Application Server Java's Web Container allows unauthenticated remote attackers to manipulate file inclusion parameters within crafted HTTP logon requests, leading to inclusion and processing of arbitrary local files. Successful exploitation can expose or modify sensitive data and render portions of the server unavailable, with no public exploit identified at time of analysis but a CVSS of 9.0 reflecting full CIA impact with scope change.

Unauthenticated remote memory corruption in the SAP Kernel of SAP NetWeaver Application Server ABAP and ABAP Platform allows attackers to compromise confidentiality, integrity, and availability by sending crafted RFC requests that trigger logical errors in memory management. The CVSS 9.8 score reflects network-reachable, no-privileges, no-interaction exploitation against a foundational SAP component, though no public exploit identified at time of analysis and exploitation status beyond the vendor disclosure is not confirmed in CISA KEV.

SAP Fiori Launchpad is vulnerable to malicious URL crafting that triggers arbitrary service calls within the Fiori domain, enabling credential theft from users who interact with the crafted link. Exploitation requires no attacker privileges (PR:N per CVSS) but demands high attack complexity (AC:H) and user interaction (UI:R), meaning adversaries must possess advanced system knowledge and successfully deliver the URL to a victim. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, placing this in the medium-priority tier despite the credential-theft potential.

Content injection into SAP Gateway error messages exposes internal implementation details - specifically regex patterns and URI parsing logic - to authenticated remote attackers. Affecting SAP Gateway versions 750 through 758 and SAP_BASIS 795, the flaw allows an attacker with low-level network credentials to craft inputs that surface sensitive system internals via error responses. Confidentiality impact is rated low; integrity and availability are unaffected. No active exploitation is confirmed (CISA KEV absent), and EPSS sits at 0.01%, consistent with SSVC's 'exploitation: none' assessment.

CSS injection in SAP NetWeaver Application Server ABAP allows unauthenticated remote attackers to inject malicious Cascading Style Sheets into web pages served by the application, with exploitation requiring user interaction (clicking or accessing the affected page). The injected CSS executes in the victim's browser context, resulting in low-impact confidentiality loss; integrity and availability are not affected. CVSS 3.1 reflects the limited impact and high attack complexity required.

SAP Business Server Pages TAF_APPLAUNCHER contains a cross-site scripting vulnerability that allows unauthenticated attackers to craft malicious links redirecting users to attacker-controlled sites, potentially exposing or altering sensitive information. The vulnerability requires user interaction (clicking the link) and affects confidentiality and integrity with a CVSS score of 6.1. No active exploitation has been publicly confirmed at time of analysis.

SAP Financial Consolidation permits authenticated attackers to forcibly terminate other users' sessions, temporarily denying them access to the application. The vulnerability has limited impact, affecting only availability through session disconnection while leaving the application itself and all data integrity and confidentiality intact. CVSS score of 4.3 reflects low severity, and no public exploit code or active exploitation has been identified.

OS command injection in SAP NetWeaver Application Server for ABAP and ABAP Platform allows authenticated administrators to execute arbitrary shell commands on the server while bypassing audit logging. The vulnerability affects integrity and availability but not confidentiality, and requires high-privilege administrative access over the network with no user interaction. CVSS 6.5 reflects the high-privilege requirement despite severe impact potential.

Insufficient authorization checks in SAP Incentive and Commission Management allow authenticated users to invoke remote-enabled function modules and perform unauthorized table update operations, compromising data integrity. The vulnerability requires valid user credentials and network access but has limited scope - no confidentiality or availability impact. CVSS 4.3 (low) reflects the authentication requirement and integrity-only impact; no active exploitation or public POC identified at analysis time.

Missing authorization checks in SAP S/4HANA Condition Maintenance allow authenticated attackers to view and modify condition table records they should not have access to, compromising data confidentiality and integrity while potentially denying legitimate users access to those same records. The vulnerability requires valid user credentials but affects all versions of the affected module, with CVSS 6.3 reflecting its multi-faceted impact across three security dimensions.

Missing authorization checks in SAP Strategic Enterprise Management's Scorecard Wizard (Business Server Pages application) allow authenticated users to access restricted information and modify risk evaluation settings without proper authorization. An attacker with valid credentials can view confidential data and alter default configuration values, artificially reducing assessed risk levels to deceive risk assessment processes. No patch availability or active exploitation has been confirmed.

SQL injection in SAP HANA Deployment Infrastructure (HDI) deploy library allows high-privileged users to manipulate dynamically constructed SQL queries, potentially altering SELECT statements and compromising confidentiality and availability. Attack requires local access and high privileges (PR:H), limiting real-world risk despite SQL injection severity. No public exploit code or active exploitation has been identified at the time of analysis.

Code injection in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform allows authenticated attackers to execute arbitrary code for subscribed channel users by sending specially crafted inputs. The vulnerability has low integrity impact with no confidentiality or availability consequences. CVSS 4.3 (low severity) reflects the requirement for authenticated access, but the ability to affect other users elevates practical risk in multi-tenant environments.

Arbitrary server-side code execution in SAP Commerce Cloud via unauthenticated malicious configuration upload and code injection. Attackers can remotely exploit a misconfigured Spring Security framework to upload crafted configuration files and inject code without authentication, requiring only that a user interact with malicious content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). The vulnerability affects SAP Commerce Cloud Configuration with critical impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, though EPSS data unavailable. Patch details available in SAP Security Note 3733064.

SQL injection in SAP S/4HANA Enterprise Search for ABAP allows authenticated attackers to extract sensitive database information and crash the application via malicious SQL statements injected through improperly validated user input. The scope change (S:C) indicates potential lateral movement beyond the vulnerable component. SAP has released security patches (SAP Note 3724838) for this critical vulnerability with CVSS 9.6. No active exploitation confirmed at time of analysis, though the authentication bypass tag suggests potential credential bypass implications.

OS command injection in SAP Forecasting & Replenishment allows authenticated administrators to execute arbitrary system commands through abuse of a non-remote-enabled function, leading to complete system compromise. The vulnerability enables full read/write access to system data and potential system shutdown, though exploitation is constrained to local attack vectors and requires high-privilege administrative access (CVSS 8.2). No public exploit code or active exploitation confirmed at time of analysis, with vendor patch available via SAP Security Patch Day.

Reflected cross-site scripting (XSS) in SAP NetWeaver Application Server ABAP (Business Server Pages) allows unauthenticated attackers to inject malicious scripts via unprotected URL parameters. Successful exploitation requires victim interaction (clicking a crafted link) and affects confidentiality and integrity of application data. No public exploit code or active exploitation reported at time of analysis.

Cross-site request forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform allows unauthenticated attackers to trick authenticated users into sending unintended requests to the web server, resulting in low-impact modifications to application integrity and availability. The vulnerability requires user interaction (clicking a malicious link) and affects all versions of the platform due to insufficient CSRF token validation. No confidentiality impact is present, limiting the attack surface to state-changing operations.

Reflected cross-site scripting (XSS) in SAP BusinessObjects Business Intelligence allows authenticated attackers to inject malicious JavaScript via crafted URLs that execute in victim browsers, potentially exposing restricted information. The vulnerability requires user interaction (clicking a malicious link) and affects only confidentiality with a CVSS score of 4.1 (low severity). No public exploit code or active exploitation has been identified.

SQL injection in SAP Business Planning and Consolidation (BPC) and SAP Business Warehouse (BW) allows authenticated users to execute arbitrary SQL commands against the database. Affected versions span SAP_BW 750-758, BPC4HANA 300, and HANABPC 810/816. The scope-change vector (S:C) indicates attackers can pivot beyond the vulnerable component to compromise database resources serving multiple SAP applications. Despite critical CVSS 9.9 severity, EPSS exploitation probability remains low (0.05%, 14th percentile) with CISA SSVC indicating no current exploitation and non-automatable attack profile. SAP security note 3719353 provides remediation guidance.

SAP S/4HANA frontend OData Service (Manage Reference Structures) allows authenticated users to update and delete child entities without proper authorization checks, enabling privilege escalation and data integrity violations. The vulnerability requires valid user credentials but no special privileges, affecting systems running vulnerable S/4HANA versions. Attackers can exploit exposed OData endpoints to modify or remove reference structure data that should be protected from their access level.

SAP S/4HANA backend OData Service for Manage Reference Structures allows authenticated remote attackers to modify and delete child entities without proper authorization checks, compromising data integrity across reference data structures. The vulnerability requires valid user credentials but no elevated privileges, affecting organizations running vulnerable S/4HANA versions. CVSS 6.5 with confirmed patch availability via SAP Security Patch Day.

SAP S/4HANA OData Service for Manage Reference Equipment lacks authorization checks, allowing authenticated users to modify and delete child entities without proper access controls. The vulnerability affects S/4HANA instances with the vulnerable OData service and requires low-privilege network access, resulting in high integrity impact but no confidentiality or availability risk. No public exploit code or active exploitation has been confirmed.

SAP S/4HANA OData Service for Manage Technical Object Structures allows authenticated users to update and delete child entities without proper authorization checks, enabling unauthorized data modification. The vulnerability affects S/4HANA deployments exposing the vulnerable OData service and requires valid user credentials but no elevated privileges. CVSS base score is 4.3 (low-to-medium severity) with confirmed patch availability from SAP Security Patch Day.

SAP Landscape Transformation allows high-privileged remote attackers to inject arbitrary ABAP code and operating system commands through an RFC-exposed function module, resulting in limited integrity impact where attackers cannot control the scope or extent of modifications. The attack requires high privileges, high complexity, and user interaction, reflected in a CVSS 2.0 score; no public exploit code or active exploitation has been identified.

Cross-site scripting via code injection in SAP NetWeaver Application Server Java Web Dynpro allows unauthenticated remote attackers to inject arbitrary client-side code through crafted input, compromising user sessions and application data integrity when victims interact with the affected functionality. CVSS 6.1 (medium) reflects the requirement for user interaction and limited scope, but exploitation is straightforward with no authentication needed and low attack complexity.

SAP S/4HANA (Private Cloud and On-Premise) allows authenticated local network users to delete arbitrary operating system files due to missing authorization checks, degrading system integrity and availability. The vulnerability requires prior authentication and high complexity attack conditions (AC:H), resulting in a CVSS score of 4.9. No evidence of active exploitation or public proof-of-concept code has been identified, but the authorization bypass is confirmed across both deployment models.

Insecure session management in SAP Business Objects Business Intelligence Platform allows unauthenticated attackers to obtain and reuse valid session tokens, enabling unauthorized access to victim sessions with moderate complexity. An attacker exploiting this vulnerability could access or modify information within the compromised session's scope, affecting confidentiality and integrity. The attack requires user interaction (UI:R) and high attack complexity (AC:H), limiting real-world exploitation but still warranting prioritized remediation for organizations running affected BI Platform versions.

Reflected Cross-Site Scripting (XSS) in SAP Supplier Relationship Management (SRM) SICF Handler allows unauthenticated remote attackers to craft malicious URLs that, when accessed by victims, execute arbitrary JavaScript within their browsers. Successful exploitation enables attackers to steal session credentials, modify procurement data, or perform actions on behalf of authenticated users, affecting confidentiality and integrity of SRM operations. The vulnerability carries a CVSS score of 6.1 with moderate real-world risk due to required user interaction and cross-origin constraints, though no public exploit code or active exploitation has been confirmed at the time of analysis.

SAP Human Capital Management for SAP S/4HANA allows authenticated users with low privileges to enumerate and guess sensitive information through specific authorization check messages, resulting in information disclosure beyond their authorized scope. The vulnerability affects SAP HCM across affected versions and requires low-privilege authenticated access to exploit, with a CVSS score of 6.5 reflecting high confidentiality impact but no integrity or availability compromise.

SAP HANA Cockpit and HANA Database Explorer leak sensitive information to authenticated network users due to improper credential storage mechanisms (CWE-522). An authenticated attacker with network access can retrieve confidential data without requiring elevated privileges or user interaction. This vulnerability affects all versions of SAP HANA Cockpit and HANA Database Explorer; patch availability and active exploitation status are not confirmed from available data.

Missing authorization checks in SAP Business Analytics and SAP Content Management allow authenticated users to invoke unauthorized remote function module calls, enabling confidential data access beyond their assigned permissions. The vulnerability affects all versions of the product and carries a CVSS score of 6.5 with confirmed high confidentiality impact. No public exploit code or active exploitation has been reported at time of analysis.