Sap Se
Monthly
An authorization bypass in SAP ABAP Platform lets a low-privileged, authenticated user open the session manager in single transaction mode - including through the Fiori Launchpad (FLP) - and then send crafted requests that defeat restrictions the platform had previously enforced correctly. The weakness is a regression: an underlying SAP API change reintroduced a flaw that had already been fixed, so only ABAP Platform deployments carrying that regressed API (and not yet covered by SAP Note 3626303) are exposed. Impact is rated 7.1 with high integrity and low confidentiality consequences and no availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N); valid low-privilege credentials are mandatory, so this is an authenticated privilege-escalation-style issue rather than a pre-auth intrusion path, and no public exploit identified at time of analysis.
SQL injection in SAP Commerce Cloud lets an authenticated user with only low-level privileges (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) inject arbitrary SQL through specially crafted requests into the affected out-of-the-box functionality, with the potential to read, modify or delete sensitive application database data and therefore high confidentiality, integrity and availability impact. The flaw is CWE-89 in code delivered as part of SAP Commerce Cloud itself, meaning it is not confined to a customer's custom extensions, but the advisory does not name the exact endpoint or parameter, so the precise injectable surface is not confirmed from available data. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only real precondition is obtaining a valid authenticated session, which is a low barrier for deployments that allow customer self-registration or maintain numerous back-office accounts. This is a genuine high-priority vulnerability, though not an emergency.
Server-side request forgery in the SAP Cloud SDK for Python lets remote, unauthenticated attackers redirect OAuth2 token requests to a server they control by manipulating the tenant_subdomain value used to build the token endpoint URL, resulting in exfiltration of the application's OAuth2 client credentials. Exposure is limited to multi-tenant SAP BTP applications that use the SDK for OAuth2 token acquisition and allow attacker influence over the tenant_subdomain input; single-tenant deployments, or those that do not derive the token URL from attacker-supplied data, are not exposed. The vulnerability carries a maximum-severity score of CVSS 10.0, and no public exploit code was identified at time of analysis; no confirmed actively exploited (CISA KEV) status applies.
SAP NetWeaver Visual Composer fails to enforce sufficient authorization checks within certain portal functionality, allowing a low-privileged authenticated user to invoke internal operations against a preconfigured remote system; depending on how that remote connection is configured, the attacker could fully compromise the destination system, with high impact on confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting the scope change that carries impact from the vulnerable portal into the connected remote system. Exploitation requires a valid low-privileged portal session (not anonymous access) plus an existing preconfigured remote destination reachable through Visual Composer, and there is currently no public exploit identified at time of analysis.
SAP MII's administrative account-provisioning function fails to enforce proper authorization boundaries, enabling an attacker who already holds MII administrator privileges to craft a request that provisions an account with elevated privileges on the underlying Java application server. This can extend compromise beyond MII to the host, with high confidentiality, integrity, and availability impact, and is reflected in a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in SAP S/4HANA's Manage Substitution/Validation Rules allows an authenticated attacker who already holds rule-maintenance business authorizations to submit crafted rule definitions that the rule-processing logic interprets as executable ABAP, resulting in full compromise of the affected system with high impact to confidentiality, integrity and availability (CVSS 9.9, Scope:Changed). Reaching the vulnerable code path requires an account provisioned with substitution/validation rule creation or maintenance privileges, so the practical barrier is authorization scope rather than authentication alone. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory (SAP Security Note 3805589) should be treated as urgent given the code-injection primitive and the privileged business role required.
Unauthenticated remote denial of service affects SAP NetWeaver and SAP Web Dispatcher deployments in which the Internet Communication Manager (ICM) internal protocol component can be reached by an attacker; a specially crafted request carrying invalid field values triggers an integer underflow (CWE-191) that corrupts memory handling and crashes the affected process. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning any network-reachable instance is exposed with no credentials or user interaction required, but the consequence is strictly service disruption - there is no confidentiality or integrity impact and no demonstrated path to data disclosure, tampering, or code execution. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the practical risk driver is therefore exposure of the ICM/Web Dispatcher protocol endpoint rather than active exploitation, with internet-facing systems materially more at risk than segmented internal ones.
Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis.
Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw.
Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis.
Session hijacking in SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated remote attacker to assume another authenticated user's session by exploiting an integer underflow that causes a previously buffered request to be reprocessed in the wrong connection context. The attack is constrained by a narrow race-condition timing window requiring a victim session to be in a buffered state simultaneously, limiting mass exploitation but not targeted attacks against high-value SAP landscapes. Successful exploitation yields high confidentiality and integrity impact consistent with full session takeover; no public exploit code or active exploitation has been identified at time of analysis.
Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle.
Remote unauthenticated denial-of-service (and possible memory corruption) in SAP's Extended Passport (EPP) processing library allows an attacker to send a crafted network request with a malformed EPP header, triggering a buffer overflow (CWE-120) that leads to undefined behavior and abnormal program termination. Any SAP application relying on the vulnerable EPP processing component is affected; SAP rates it CVSS 10.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.
SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. No public exploit or active exploitation has been identified at time of analysis, but the CVSS scope change (S:C) signals that successfully decrypted credentials can be used to compromise systems beyond the BI platform itself.
Missing authorization checks in SAP ABAP Developer Tools (the Eclipse-based IDE for ABAP development) allow any low-privileged SAP user to execute unauthorized database operations against SAP NetWeaver AS ABAP backends. The flaw spans a wide range of SAP_BASIS releases (750 through 920) and yields full confidentiality, integrity, and availability compromise of the ABAP application layer - including the ability to read sensitive business data, modify application records, and disrupt legitimate user access. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage elevate real-world risk considerably for enterprises running ADT-connected NetWeaver systems.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible due to a missing authorization check on scheduling-related API endpoints. Any network-reachable attacker without credentials can retrieve, create, modify, or delete scheduling data managed by the application, impacting confidentiality, integrity, and availability at a low severity level each. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions - no authentication, no user interaction, low complexity - lower the barrier to opportunistic abuse significantly.
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend operations to unauthenticated remote attackers via crafted HTTP requests with specific parameter values. Successful exploitation grants read, create, modify, and delete access to application-managed business data, producing a limited but tripartite impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at this time, though the zero-privilege network vector lowers the bar for opportunistic probing.
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outside intended directory boundaries by supplying specially crafted input to affected file path validation functions. Exploitation requires a legitimate user to subsequently interact with the attacker-influenced content and depends on conditions outside the attacker's direct control, as reflected by the AC:H and UI:R CVSS metrics. Successful exploitation achieves a scope change affecting adjacent components with high impact on confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing exist at time of analysis.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Insecure deserialization in the SAP Change and Transport System Attach Tool (ctsattach) lets an authenticated, low-privileged attacker achieve remote code execution by supplying a crafted archive that a victim then processes through the tool's library. Successful exploitation yields high confidentiality and integrity impact - attackers can read sensitive data and take control of the host and its processes - with low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause and 7.6 CVSS make this a meaningful patch priority for SAP landscapes.
Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed.
Reflected cross-site scripting in SAP NetWeaver Application Server Java (specifically the Configuration Wizard component) lets an unauthenticated attacker embed malicious JavaScript in crafted URLs that executes in a victim's browser when the link is opened. Because the CVSS scope is changed (S:C) and confidentiality impact is high, a successful lure can expose sensitive session information and tamper with non-sensitive data rendered in the client. No public exploit identified at time of analysis, but the 8.2 CVSS and unauthenticated, network-reachable vector make it a meaningful phishing-driven risk for exposed SAP portals.
Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack.
Unauthorized access in SAP Approuter arises because the component fails to validate incoming request headers during the OAuth2 login flow under certain configurations (CWE-601, open redirect). An unauthenticated remote attacker who lures a victim into clicking a crafted link can hijack the authentication flow to gain high-confidentiality and high-integrity access to the application. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, low-complexity nature (CVSS 8.1) makes it a meaningful patch priority for SAP BTP/Cloud Foundry environments.
Request-response desynchronization in SAP Approuter lets an unauthenticated remote attacker send a specially crafted HTTP request that smuggles a second request past the front end, allowing exposure of other users' HTTP responses and denial of service against the application. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) and was reported by SAP; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in SAProuter on Microsoft Windows lets a local attacker plant a malicious DLL in an untrusted search-path location that SAProuter loads at runtime, hijacking the DLL loading process to run attacker code with the privileges of the SAProuter service. The flaw was reported by SAP and carries a CVSS 8.4 with full High impact on confidentiality, integrity, and availability; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SAProuter typically runs as a persistent network gateway service, successful exploitation can compromise a strategically positioned host in an SAP landscape.
Arbitrary server-side code execution in SAP Commerce Cloud via unauthenticated malicious configuration upload and code injection. Attackers can remotely exploit a misconfigured Spring Security framework to upload crafted configuration files and inject code without authentication, requiring only that a user interact with malicious content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). The vulnerability affects SAP Commerce Cloud Configuration with critical impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, though EPSS data unavailable. Patch details available in SAP Security Note 3733064.
SQL injection in SAP S/4HANA Enterprise Search for ABAP allows authenticated attackers to extract sensitive database information and crash the application via malicious SQL statements injected through improperly validated user input. The scope change (S:C) indicates potential lateral movement beyond the vulnerable component. SAP has released security patches (SAP Note 3724838) for this critical vulnerability with CVSS 9.6. No active exploitation confirmed at time of analysis, though the authentication bypass tag suggests potential credential bypass implications.
OS command injection in SAP Forecasting & Replenishment allows authenticated administrators to execute arbitrary system commands through abuse of a non-remote-enabled function, leading to complete system compromise. The vulnerability enables full read/write access to system data and potential system shutdown, though exploitation is constrained to local attack vectors and requires high-privilege administrative access (CVSS 8.2). No public exploit code or active exploitation confirmed at time of analysis, with vendor patch available via SAP Security Patch Day.
Authenticated remote attackers can overwrite eight-character executable ABAP reports in SAP ERP and SAP S/4HANA systems due to missing authorization checks, enabling denial-of-service conditions when legitimate users execute corrupted reports. This authorization bypass (CWE-862) requires low-privilege authenticated access (CVSS PR:L) and has low attack complexity, combining limited integrity impact with high availability impact (CVSS 7.1). EPSS data not provided; no public exploit identified at time of analysis. Affects SAP ERP and SAP S/4HANA Private Cloud and On-Premise deployments.
An authenticated low-privileged user can access sensitive information beyond their authorized scope in SAP HANA's 'Display Product Catalog Based on Customs Declaration' application due to insufficient authorization checks (CWE-863). The vulnerability is network-accessible but requires a valid account and results in partial confidentiality impact only, with no effect on integrity or availability (CVSS 4.3). No public exploit code or active exploitation has been identified at time of analysis.
Open redirect in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, enabling user-information tracking and page defacement. The vulnerability requires user interaction (UI:R) and results in low confidentiality and integrity impact with no availability impact, yielding a CVSS score of 6.1. No public exploit code has been identified at time of analysis.
Improper authorization checks in SAP S/4HANA's Linear Asset Management RAP business object allow an authenticated, low-privilege user with local/interactive access to modify associated business object data for which they lack authorization, producing a high integrity impact with no confidentiality or availability impact (CVSS 4.7). Exploitation requires high attack complexity and specific runtime or data-association conditions, and no remote or unauthenticated path is described; no public exploit identified at time of analysis. SAP has assigned CWE-862 and published remediation guidance via SAP Security Note 3799621.
Unauthenticated information disclosure in SAP NetWeaver Enterprise Portal allows remote attackers to bypass resource restrictions and retrieve non-critical application information, producing only a low confidentiality impact (CVSS 5.3). The issue is mapped to CWE-552 and tagged as path traversal, so exposed portals may leak reconnaissance-grade data rather than credentials or code execution. No public exploit identified at time of analysis; exposure is reduced when the portal is not internet-facing or is protected by a reverse proxy/WAF that filters traversal patterns.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal allows unauthenticated remote attackers to inject a malicious script into a URL parameter that is reflected back in the server response, where it executes in the browser of any portal user who opens the crafted link. Exploitation depends on user interaction (CVSS 3.1 base 6.1, MEDIUM, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and can result in theft of session information, manipulation of portal content, or redirection of the victim. No public exploit identified at time of analysis.
Command injection in SAP Yeoman UI (app-studio-toolkit) enables an attacker to execute arbitrary OS commands with the developer's privileges by crafting a malicious workspace settings.json that sets ApplicationWizard.installationLocation to a shell payload. The command fires when the developer triggers a generator installation or uninstallation, which invokes child_process.execSync with the unsanitized value. The assessed CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local exploitation requiring user interaction, with high impact to confidentiality, integrity, and availability on the developer workstation; no confirmed active exploitation or public exploit code is identified in the provided data.
Broken access control in SAP CLA Assistant lets any authenticated low-privilege user read the CLA signature records of an organisation they do not administer by supplying that organisation's ID to the admin API endpoint that retrieves signature records; the missing authorization check on the ID-based lookup path exposes contributor names and other signature metadata (CVSS 3.1 score 6.5, CWE-862 Missing Authorization, confidentiality-only impact). Exploitation requires a valid authenticated session with limited privileges and knowledge or enumeration of a valid organisation ID, so it is a targeted information-disclosure issue rather than an unauthenticated compromise. No public exploit identified at time of analysis, and no evidence of active exploitation.
Insufficient input validation in SAP UI5 allows an authenticated, low-privileged user to submit crafted content that is later rendered in another user's browser, producing a low-impact client-side injection (CVSS 4.4, Medium) that can affect the confidentiality and integrity of the victim's session but not availability. Exploitation is substantially constrained: the assessed vector (AV:N/AC:H/PR:L/UI:R/S:C) requires a valid low-privilege account, the application to be running in one of the specific non-default configurations where validation is inadequate, and a victim to actively open or render the view containing the attacker-supplied content. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exact vulnerable configuration is addressed in SAP Note 3799054.
Token trust-source confusion in SAP's cloud-security-services-integration-library lets the HybridTokenAuthenticator component accept identity tokens minted by an IAS/XSUAA service binding that was never intended as the application's trust source, resulting in unauthorized access at limited confidentiality and integrity impact (CVSS 3.1 base 4.2, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, no availability impact). Only deployments bound to multiple IAS/XSUAA service instances are exposed: an 'ambient' binding must exist for the flaw to trigger, and remote attackers must already hold a valid token issued by that ambient binding before they can authenticate, so single-binding SAP BTP Cloud Foundry applications are not affected. There is no public exploit identified at time of analysis, and all available signals point to a genuinely low-priority issue rather than an urgent one.
Cross-site scripting in applications based on SAP GUI for HTML on SAP NetWeaver Application Server ABAP lets an authenticated attacker (PR:L) inject malicious content through functionality that does not sufficiently sanitize user-supplied input, with the script executing in a second user's browser once that victim interacts with the poisoned content (UI:R). The flaw is rated CVSS 5.4 (CWE-79), with scope change and low confidentiality/integrity impact and no availability impact; SAP is the reporting vendor and has published Security Note 3671819. There is no public exploit identified at time of analysis and no CISA KEV listing, so this should be treated as a medium-severity, credentialed-to-credentialed escalation path rather than an internet-facing emergency.
DOM-based cross-site scripting in the SAPUI5 Support Assistant Overlay lets an unauthenticated attacker craft a publicly hosted link that, when opened by a logged-in SAP user, causes attacker-controlled input to be read by client-side code and written into the DOM without sanitization, executing script in that user's browser context. Exploitation is not automatic: it requires the Overlay component to be present and reachable plus user interaction (UI:R), so the attacker must socially engineer a specific authenticated victim into clicking the link. There is no public exploit identified at time of analysis and no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with limited confidentiality and integrity impact on the victim's browser scope and no availability impact.
Stored cross-site scripting in SAP Manufacturing Integration and Intelligence (MII) lets an authenticated, low-privileged attacker persist malicious content that is later rendered and executed in the browser of an authenticated victim who opens the affected page. Scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires a valid low-privileged MII account to plant the payload plus victim navigation to the tainted page, so exploitation is limited to the victim's browser context: session information access, modified page content, and local disruption of the application, not server compromise. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Low-privileged attackers positioned on a network adjacent to an SAP Cloud Connector can extract limited information about internal systems by sending specially crafted requests that slip past a flawed authorization check. Exploitation carries a dual prerequisite - adjacency to the connector (AV:A, so not reachable from the public internet) plus valid low-privilege credentials (PR:L) - and the resulting impact is confined to low confidentiality loss with no effect on integrity or availability, which is why this is assessed as a genuinely low-priority issue despite being a real vulnerability at CVSS 3.5. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); no EPSS data was supplied with this report.
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input, so an unauthenticated attacker can craft a malicious link that, once clicked by a logged-in user, makes the victim's browser pull attacker-controlled content from an external location and potentially expose data from the active session, producing a high confidentiality impact with no effect on integrity or availability. The issue is network-reachable (AV:N) but requires specific crafting conditions (AC:H) plus victim interaction (UI:R), while the attacker needs no credentials (PR:N); the assessed base score is 5.3 (Medium) on vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. No public exploit code was identified at time of analysis, and the weakness class (CWE-95) points to injection into dynamically evaluated code rather than a default-configuration remote compromise, so the realistic risk is a targeted phishing-style data-theft attempt against authenticated launchpad users with sensitive in-session data.
SAPUI5's frame options allowlist feature insufficiently validates parent frame origins, enabling a framing-based social engineering attack against authenticated SAP users. An unauthenticated attacker can host a malicious page that embeds a SAPUI5 application in an iframe while bypassing the configured origin allowlist, then lure an authenticated victim into interacting with it to trigger unintended in-application actions. Impact is limited to low integrity - no confidentiality or availability consequences - and no public exploit or active exploitation (KEV) has been identified.
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day.
Unauthorized administrative interface access in SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server exposes sensitive system state to authenticated low-privileged users. Exploiting this flaw, an attacker with only a basic SAP account can query administrative endpoints normally restricted to higher-privilege roles, retrieving configuration details, system internals, or operational data that could serve as reconnaissance for follow-on attacks. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low authentication bar (any valid low-privilege account) and direct network accessibility make the exposure surface meaningful in enterprise SAP environments.
Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. Impact is confined to confidentiality at a low level; no public exploit or CISA KEV listing has been identified at time of analysis.
Insufficient authorization enforcement in SAP S/4HANA's Manage Bank Chains application allows an authenticated low-privileged user to delete bank chain records outside their permitted scope. The impact is strictly limited to availability - deletion of specific configuration entries - with no confidentiality or integrity exposure, yielding a CVSS 4.3 moderate rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craft a malicious link or page that, when interacted with by an authenticated victim, triggers unintended server-side actions on their behalf. The impact is limited to low-integrity and low-confidentiality effects with no availability impact, confirmed by SAP as part of Security Patch Day (Note 3371336). No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity.
Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected.
Transient CPU exhaustion in SAP Process Integration's SOAP Adapter allows a privileged authenticated user to craft SOAP requests containing deeply nested XML entity definitions (CWE-776, 'XML Bomb' class), temporarily degrading system responsiveness. The vulnerability scores CVSS 2.2, reflecting that exploitation requires high privileges, high attack complexity, and yields only low availability impact with zero confidentiality or integrity consequences. No public exploit code and no CISA KEV listing have been identified, placing this firmly in the low-priority tier despite network reachability.
SQL injection in SAP S/4HANA's Intercompany Matching and Reconciliation (ICR) module allows a low-privileged authenticated user to exfiltrate sensitive data from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard SAP user account, with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based reflected Cross-Site Scripting in SAP NetWeaver Application Server ABAP enables an authenticated attacker to craft a malicious URL and distribute it to other authenticated SAP users. When a victim accesses the link, unsanitized input is reflected and executed within the DOM in the victim's browser, resulting in high confidentiality impact - such as session token or credential theft - and low integrity impact. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the high confidentiality component.
Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attackers to send specially crafted requests that bypass header sanitization, resulting in limited unauthorized information disclosure from internal backend components. All SAP Approuter Node.js package versions below 23.0.0 are affected, with a vendor-released patch available at version 23.0.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the zero-authentication requirement and low attack complexity make it accessible to opportunistic actors targeting exposed SAP BTP deployments.
Path traversal authorization bypass in SAP Approuter (Node.js package, versions prior to 23.0.0) enables a low-privileged authenticated attacker to send specially crafted requests that escape the Approuter's routing authorization controls and reach protected backend destinations beyond their assigned scope. Successful exploitation yields high confidentiality impact - exposure of sensitive backend data - and limited integrity impact through restricted modifications to protected resources, with no effect on availability. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by high attack complexity per the CVSS AC:H rating.
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privilege attacker to hijack another user's session by sending crafted requests that circumvent header integrity verification on certain code paths. Exploitation demands prior out-of-band observation of the target's session values, constraining this to determined, targeted attackers rather than opportunistic mass exploitation. No public exploit code and no CISA KEV listing identified at time of analysis, but successful exploitation yields full read access to the victim's session context with a high confidentiality impact per CVSS.
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.
Improper error condition handling in SAP Approuter (the node.js routing component of SAP Business AI Platform) allows a low-privileged network attacker to cause a partial availability disruption under a non-default configuration. The attack is highly complex, requiring conditions outside the attacker's control, and produces only low availability impact with no confidentiality or integrity loss. No public exploit has been identified at time of analysis, and a vendor patch is available in Approuter node.js package version 23.0.0 and later.
Open redirect exploitation in SAP's python-pyodata library (versions before 1.11.2) allows a malicious or compromised OData service to capture sensitive authentication information transmitted by the client and inject untrusted data into the consuming application. Applications using pyodata that connect to externally controlled or attacker-reachable OData endpoints are at risk of credential disclosure and data integrity compromise. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV, but a vendor-released patch is available at version 1.11.2.
SAP BusinessObjects Business Intelligence Platform (Admin Tools) fails to enforce authorization checks on certain administrative functions, allowing an authenticated low-privilege user to access restricted information. Affected versions include the 2025 release and ENTERPRISE 430. The flaw is classified as CWE-862 (Missing Authorization) and carries a CVSS 4.3 rating with no public exploit identified at time of analysis and no CISA KEV listing.
Stored cross-site scripting in SAPUI5's content adaptation feature allows a key user with content adaptation privileges to inject persistent malicious scripts into adapted application definitions. When any user subsequently opens the compromised adapted application, the injected script executes in their browser session, enabling session token theft and unauthorized actions on behalf of the victim. Affected versions span multiple SAPUI5 release tracks (754 through 816 and SAP_UI 750); no public exploit or CISA KEV listing has been identified at time of analysis.
SQL DDL injection in SAP Social Intelligence (versions 102-109) allows an authenticated low-privilege network attacker to directly execute Data Definition Language commands against the underlying database. Exploitation can alter or destroy database schema objects - a more structurally damaging capability than typical DML injection - with vendor-rated Low impact across confidentiality, integrity, and availability. No active exploitation confirmed at time of analysis and no public exploit identified; patch details are available via SAP Security Note 3766473.
Privilege escalation in SAP S/4HANA's Reprocess Bank Statement Items component allows authenticated users to invoke processing rules that have not been explicitly shared with them, circumventing intended access controls. Affected versions span S4CORE releases 104 through 109, covering a broad swath of actively supported SAP S/4HANA deployments. The impact is confined to low-severity information disclosure - unauthorized rule access reveals restricted bank statement logic - with no integrity or availability consequences; no public exploit or active exploitation has been identified at the time of analysis.
Unbounded memory growth in SAP Business AI Platform (Approuter) allows a low-privileged authenticated attacker to degrade availability by flooding the application with high-volume data while suppressing response consumption. The vulnerability stems from insufficient flow control, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). Confidentiality and integrity are unaffected; the impact is limited to availability, and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Certificate validation bypass in SAP Approuter node.js package (versions prior to 23.0.0) enables a low-privileged network attacker holding a certificate from the same trusted CA with matching subject values to impersonate trusted internal components during certain callback flows. The attack path is constrained by high complexity - the attacker must satisfy specific PKI prerequisites - but successful exploitation yields high integrity impact through component impersonation. No public exploit code or CISA KEV listing has been identified at time of analysis.
XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence (Web Intelligence) enables a low-privileged authenticated attacker to read arbitrary server-side files by uploading a crafted spreadsheet containing malicious external entity references and using it as a report data source. Affected versions span the 2025, 2027, ENTERPRISE 430, and ENTERPRISECLIENTTOOLS 430 release lines, all confirmed by ENISA EUVD-2026-55877 and SAP Note 3753141. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low authentication bar and high confidentiality impact make this a material risk for any enterprise running Web Intelligence.
Memory disclosure in SAP ABAP Platform exposes residual data from previously allocated memory buffers to unauthenticated remote attackers via a specially crafted request to an internal component. Affected deployments include ABAP Platform 7.54, KERNEL 7.53, KRNL64UC 7.53, and 7.77, with the vendor characterizing the leaked data as limited and non-sensitive. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, consistent with the moderate CVSS 5.3 rating reflecting low confidentiality impact with no integrity or availability consequences.
Hardcoded credentials embedded in SAP Advanced Planning and Optimization (Model Mix Planning) source code enable authenticated high-privilege attackers to bypass the application's authorization layer and delete specific planning-related restrictions. Confirmed by SAP via Security Note 3763028 and disclosed on SAP Security Patch Day, the flaw spans a wide range of APO versions including SCM 700, S4CORE, and S4COREOP release lines. No public exploit code exists and the vulnerability is not listed in CISA KEV; real-world impact is constrained by the high-privilege prerequisite and limited to low-severity confidentiality and integrity effects.
Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows any low-privileged authenticated user to access user account information that is intended to be restricted to privileged roles. The exposed account data - names, identifiers, or contact details of privileged users - can directly enable targeted follow-on attacks such as spear phishing or credential stuffing against identified administrator accounts. No public exploit code or active exploitation has been identified at time of analysis; CVSS 3.1 rates this Medium (4.3) with low confidentiality impact and no integrity or availability impact.
Unauthorized configuration table modification in SAP NetWeaver and ABAP Platform's Change and Transport System (CTS) Customer Transport Integration Wizard allows a low-privileged authenticated user to alter access controls for data objects during specific wizard operations. Affected SAP_BASIS releases span from 740 through 816, covering a broad range of enterprise SAP landscapes. The practical impact is limited to processing delays and operational disruption (low integrity and availability), with no confidentiality exposure; no public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog.
Tenant context spoofing in SAP Approuter (node.js package < 23.0.0) allows unauthenticated remote attackers to craft requests that bypass tenant isolation, resulting in limited cross-tenant information disclosure. Exploitation is constrained by High Attack Complexity (AC:H per vendor CVSS), meaning conditions necessary for success are not fully under attacker control. No public exploit has been identified at time of analysis and a vendor patch is available, making this a low-urgency but compliance-relevant issue for SAP BTP multi-tenant deployments.
Denial-of-service in SAP Approuter (SAP Business AI Platform), the node.js routing and authentication gateway for SAP BTP applications, allows remote unauthenticated attackers to crash and restart the component by sending specially crafted input under specific runtime conditions. All versions of the SAP Approuter node.js package prior to 23.0.0 are affected, with high availability impact and no confidentiality or integrity exposure. No public exploit has been identified at time of analysis, and SAP has released a patch via Security Note 3786038.
Insufficient authorization enforcement in the WebSocket layer of SAP Approuter (node.js package < 23.0.0) allows a low-privileged authenticated attacker to reach functionality that should be access-controlled. Successful exploitation yields high confidentiality impact - exposure of sensitive data routed through the Approuter - and limited data modification capability, with no effect on availability. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available and should be prioritized for SAP BTP environments.
OS command injection in SAP NetWeaver Application Server ABAP and ABAP Platform enables an attacker holding high-privilege credentials to bypass missing security controls on an internal ABAP code path and execute arbitrary commands on the underlying operating system. Affected releases span kernel versions 7.22 through 9.16, placing a broad range of production SAP landscapes at risk of service disruption or unauthorized OS-level writes. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high availability impact (A:H) makes it a meaningful patch priority for SAP Basis teams.
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stack-based buffer overflow in SAP SAPSPrint Service (CWE-121) allows unauthenticated remote attackers to crash the service via specially crafted command requests, triggering an automatic service restart. The impact is limited to low availability disruption with no confidentiality or integrity compromise. No public exploit code or active exploitation has been identified at time of analysis, and SAP has addressed this vulnerability via their Security Patch Day cycle.
CSS stylesheet injection in SAP @ui5/webcomponents-base allows unauthenticated remote attackers to load arbitrary cross-origin stylesheets into victim pages by bypassing the sap-allowed-theme-origins allowlist enforcement inside setThemeRoot(). The ?sap-themeRoot URL query parameter is a direct delivery vector, making socially-engineered exploitation trivial - no authentication is required from the attacker (CVSS PR:N), only a victim page load (UI:R). Successful exploitation enables UI redressing, clickjacking, phishing overlays, visual defacement, and limited CSS attribute-selector-based data exfiltration; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in SAP S/4HANA's Draft Operation component allows authenticated restricted users to read entity data beyond their authorized scope due to missing authorization checks. The flaw, classified under CWE-862, is exploitable over the network without elevated privileges, resulting in low confidentiality impact with no effect on integrity or availability. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk bounded despite the network-accessible attack vector.
Missing authorization in SAP S/4HANA's Create Single Payment function exposes restricted entity set keys to authenticated but low-privileged users. The flaw (CWE-862) allows a restricted user to query specific payment-related entity sets beyond their intended access scope, resulting in low-impact confidentiality leakage with no effect on data integrity or system availability. No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS data was not provided, but the CVSS 4.3 medium score and limited impact scope suggest low exploitation urgency.
SQL injection in SAP S/4HANA Project Management (PPM-PRO) allows a high-privileged authenticated attacker to execute crafted database queries, exposing backend database contents. The vulnerability is reachable over the network but requires both high attack complexity and high privilege level, significantly constraining the realistic attacker pool. No public exploit or active exploitation has been identified at time of analysis, and the CVSS base score of 5.5 reflects these mitigating factors despite the potential for database exposure.
Script injection in SAP CRM WebClient UI is enabled by absent Content Security Policy (CSP) directives for certain restrictive headers, allowing an authenticated low-privileged attacker to inject malicious JavaScript that executes in a victim user's browser session. The CVSS vector (PR:L/UI:R/S:C) confirms this requires both an authenticated attacker and victim interaction, with a cross-scope impact consistent with browser-context script execution. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis, and impact is bounded to low integrity with no confidentiality or availability consequence.
Reflected XSS in SAP NetWeaver Application Server ABAP's Business Server Pages (BSP) framework allows remote unauthenticated attackers to inject arbitrary JavaScript into HTTP responses when a victim user interacts with a crafted URL. Successful exploitation enables session token theft and execution of authenticated actions on behalf of the victim within the SAP web context. No public exploit code or CISA KEV listing is identified at time of analysis; CVSS AC:H indicates non-trivial conditions must align for successful delivery, moderating real-world risk despite the enterprise sensitivity of SAP environments.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal enables unauthenticated remote attackers to inject arbitrary JavaScript into URL parameters that are echoed back unencoded in server responses. When a victim with an active portal session visits a crafted URL, the injected script executes in their browser under the portal's origin, permitting session token theft, unauthorized manipulation of portal content, or forced redirection to attacker-controlled resources. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the unauthenticated network-accessible attack surface and low complexity make phishing-based delivery operationally straightforward.
An authorization bypass in SAP ABAP Platform lets a low-privileged, authenticated user open the session manager in single transaction mode - including through the Fiori Launchpad (FLP) - and then send crafted requests that defeat restrictions the platform had previously enforced correctly. The weakness is a regression: an underlying SAP API change reintroduced a flaw that had already been fixed, so only ABAP Platform deployments carrying that regressed API (and not yet covered by SAP Note 3626303) are exposed. Impact is rated 7.1 with high integrity and low confidentiality consequences and no availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N); valid low-privilege credentials are mandatory, so this is an authenticated privilege-escalation-style issue rather than a pre-auth intrusion path, and no public exploit identified at time of analysis.
SQL injection in SAP Commerce Cloud lets an authenticated user with only low-level privileges (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) inject arbitrary SQL through specially crafted requests into the affected out-of-the-box functionality, with the potential to read, modify or delete sensitive application database data and therefore high confidentiality, integrity and availability impact. The flaw is CWE-89 in code delivered as part of SAP Commerce Cloud itself, meaning it is not confined to a customer's custom extensions, but the advisory does not name the exact endpoint or parameter, so the precise injectable surface is not confirmed from available data. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only real precondition is obtaining a valid authenticated session, which is a low barrier for deployments that allow customer self-registration or maintain numerous back-office accounts. This is a genuine high-priority vulnerability, though not an emergency.
Server-side request forgery in the SAP Cloud SDK for Python lets remote, unauthenticated attackers redirect OAuth2 token requests to a server they control by manipulating the tenant_subdomain value used to build the token endpoint URL, resulting in exfiltration of the application's OAuth2 client credentials. Exposure is limited to multi-tenant SAP BTP applications that use the SDK for OAuth2 token acquisition and allow attacker influence over the tenant_subdomain input; single-tenant deployments, or those that do not derive the token URL from attacker-supplied data, are not exposed. The vulnerability carries a maximum-severity score of CVSS 10.0, and no public exploit code was identified at time of analysis; no confirmed actively exploited (CISA KEV) status applies.
SAP NetWeaver Visual Composer fails to enforce sufficient authorization checks within certain portal functionality, allowing a low-privileged authenticated user to invoke internal operations against a preconfigured remote system; depending on how that remote connection is configured, the attacker could fully compromise the destination system, with high impact on confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting the scope change that carries impact from the vulnerable portal into the connected remote system. Exploitation requires a valid low-privileged portal session (not anonymous access) plus an existing preconfigured remote destination reachable through Visual Composer, and there is currently no public exploit identified at time of analysis.
SAP MII's administrative account-provisioning function fails to enforce proper authorization boundaries, enabling an attacker who already holds MII administrator privileges to craft a request that provisions an account with elevated privileges on the underlying Java application server. This can extend compromise beyond MII to the host, with high confidentiality, integrity, and availability impact, and is reflected in a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in SAP S/4HANA's Manage Substitution/Validation Rules allows an authenticated attacker who already holds rule-maintenance business authorizations to submit crafted rule definitions that the rule-processing logic interprets as executable ABAP, resulting in full compromise of the affected system with high impact to confidentiality, integrity and availability (CVSS 9.9, Scope:Changed). Reaching the vulnerable code path requires an account provisioned with substitution/validation rule creation or maintenance privileges, so the practical barrier is authorization scope rather than authentication alone. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory (SAP Security Note 3805589) should be treated as urgent given the code-injection primitive and the privileged business role required.
Unauthenticated remote denial of service affects SAP NetWeaver and SAP Web Dispatcher deployments in which the Internet Communication Manager (ICM) internal protocol component can be reached by an attacker; a specially crafted request carrying invalid field values triggers an integer underflow (CWE-191) that corrupts memory handling and crashes the affected process. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning any network-reachable instance is exposed with no credentials or user interaction required, but the consequence is strictly service disruption - there is no confidentiality or integrity impact and no demonstrated path to data disclosure, tampering, or code execution. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the practical risk driver is therefore exposure of the ICM/Web Dispatcher protocol endpoint rather than active exploitation, with internet-facing systems materially more at risk than segmented internal ones.
Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis.
Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw.
Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis.
Session hijacking in SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated remote attacker to assume another authenticated user's session by exploiting an integer underflow that causes a previously buffered request to be reprocessed in the wrong connection context. The attack is constrained by a narrow race-condition timing window requiring a victim session to be in a buffered state simultaneously, limiting mass exploitation but not targeted attacks against high-value SAP landscapes. Successful exploitation yields high confidentiality and integrity impact consistent with full session takeover; no public exploit code or active exploitation has been identified at time of analysis.
Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle.
Remote unauthenticated denial-of-service (and possible memory corruption) in SAP's Extended Passport (EPP) processing library allows an attacker to send a crafted network request with a malformed EPP header, triggering a buffer overflow (CWE-120) that leads to undefined behavior and abnormal program termination. Any SAP application relying on the vulnerable EPP processing component is affected; SAP rates it CVSS 10.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.
SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. No public exploit or active exploitation has been identified at time of analysis, but the CVSS scope change (S:C) signals that successfully decrypted credentials can be used to compromise systems beyond the BI platform itself.
Missing authorization checks in SAP ABAP Developer Tools (the Eclipse-based IDE for ABAP development) allow any low-privileged SAP user to execute unauthorized database operations against SAP NetWeaver AS ABAP backends. The flaw spans a wide range of SAP_BASIS releases (750 through 920) and yields full confidentiality, integrity, and availability compromise of the ABAP application layer - including the ability to read sensitive business data, modify application records, and disrupt legitimate user access. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage elevate real-world risk considerably for enterprises running ADT-connected NetWeaver systems.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible due to a missing authorization check on scheduling-related API endpoints. Any network-reachable attacker without credentials can retrieve, create, modify, or delete scheduling data managed by the application, impacting confidentiality, integrity, and availability at a low severity level each. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions - no authentication, no user interaction, low complexity - lower the barrier to opportunistic abuse significantly.
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend operations to unauthenticated remote attackers via crafted HTTP requests with specific parameter values. Successful exploitation grants read, create, modify, and delete access to application-managed business data, producing a limited but tripartite impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at this time, though the zero-privilege network vector lowers the bar for opportunistic probing.
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outside intended directory boundaries by supplying specially crafted input to affected file path validation functions. Exploitation requires a legitimate user to subsequently interact with the attacker-influenced content and depends on conditions outside the attacker's direct control, as reflected by the AC:H and UI:R CVSS metrics. Successful exploitation achieves a scope change affecting adjacent components with high impact on confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing exist at time of analysis.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Insecure deserialization in the SAP Change and Transport System Attach Tool (ctsattach) lets an authenticated, low-privileged attacker achieve remote code execution by supplying a crafted archive that a victim then processes through the tool's library. Successful exploitation yields high confidentiality and integrity impact - attackers can read sensitive data and take control of the host and its processes - with low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause and 7.6 CVSS make this a meaningful patch priority for SAP landscapes.
Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed.
Reflected cross-site scripting in SAP NetWeaver Application Server Java (specifically the Configuration Wizard component) lets an unauthenticated attacker embed malicious JavaScript in crafted URLs that executes in a victim's browser when the link is opened. Because the CVSS scope is changed (S:C) and confidentiality impact is high, a successful lure can expose sensitive session information and tamper with non-sensitive data rendered in the client. No public exploit identified at time of analysis, but the 8.2 CVSS and unauthenticated, network-reachable vector make it a meaningful phishing-driven risk for exposed SAP portals.
Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack.
Unauthorized access in SAP Approuter arises because the component fails to validate incoming request headers during the OAuth2 login flow under certain configurations (CWE-601, open redirect). An unauthenticated remote attacker who lures a victim into clicking a crafted link can hijack the authentication flow to gain high-confidentiality and high-integrity access to the application. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, low-complexity nature (CVSS 8.1) makes it a meaningful patch priority for SAP BTP/Cloud Foundry environments.
Request-response desynchronization in SAP Approuter lets an unauthenticated remote attacker send a specially crafted HTTP request that smuggles a second request past the front end, allowing exposure of other users' HTTP responses and denial of service against the application. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) and was reported by SAP; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in SAProuter on Microsoft Windows lets a local attacker plant a malicious DLL in an untrusted search-path location that SAProuter loads at runtime, hijacking the DLL loading process to run attacker code with the privileges of the SAProuter service. The flaw was reported by SAP and carries a CVSS 8.4 with full High impact on confidentiality, integrity, and availability; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SAProuter typically runs as a persistent network gateway service, successful exploitation can compromise a strategically positioned host in an SAP landscape.
Arbitrary server-side code execution in SAP Commerce Cloud via unauthenticated malicious configuration upload and code injection. Attackers can remotely exploit a misconfigured Spring Security framework to upload crafted configuration files and inject code without authentication, requiring only that a user interact with malicious content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). The vulnerability affects SAP Commerce Cloud Configuration with critical impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, though EPSS data unavailable. Patch details available in SAP Security Note 3733064.
SQL injection in SAP S/4HANA Enterprise Search for ABAP allows authenticated attackers to extract sensitive database information and crash the application via malicious SQL statements injected through improperly validated user input. The scope change (S:C) indicates potential lateral movement beyond the vulnerable component. SAP has released security patches (SAP Note 3724838) for this critical vulnerability with CVSS 9.6. No active exploitation confirmed at time of analysis, though the authentication bypass tag suggests potential credential bypass implications.
OS command injection in SAP Forecasting & Replenishment allows authenticated administrators to execute arbitrary system commands through abuse of a non-remote-enabled function, leading to complete system compromise. The vulnerability enables full read/write access to system data and potential system shutdown, though exploitation is constrained to local attack vectors and requires high-privilege administrative access (CVSS 8.2). No public exploit code or active exploitation confirmed at time of analysis, with vendor patch available via SAP Security Patch Day.
Authenticated remote attackers can overwrite eight-character executable ABAP reports in SAP ERP and SAP S/4HANA systems due to missing authorization checks, enabling denial-of-service conditions when legitimate users execute corrupted reports. This authorization bypass (CWE-862) requires low-privilege authenticated access (CVSS PR:L) and has low attack complexity, combining limited integrity impact with high availability impact (CVSS 7.1). EPSS data not provided; no public exploit identified at time of analysis. Affects SAP ERP and SAP S/4HANA Private Cloud and On-Premise deployments.
An authenticated low-privileged user can access sensitive information beyond their authorized scope in SAP HANA's 'Display Product Catalog Based on Customs Declaration' application due to insufficient authorization checks (CWE-863). The vulnerability is network-accessible but requires a valid account and results in partial confidentiality impact only, with no effect on integrity or availability (CVSS 4.3). No public exploit code or active exploitation has been identified at time of analysis.
Open redirect in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, enabling user-information tracking and page defacement. The vulnerability requires user interaction (UI:R) and results in low confidentiality and integrity impact with no availability impact, yielding a CVSS score of 6.1. No public exploit code has been identified at time of analysis.
Improper authorization checks in SAP S/4HANA's Linear Asset Management RAP business object allow an authenticated, low-privilege user with local/interactive access to modify associated business object data for which they lack authorization, producing a high integrity impact with no confidentiality or availability impact (CVSS 4.7). Exploitation requires high attack complexity and specific runtime or data-association conditions, and no remote or unauthenticated path is described; no public exploit identified at time of analysis. SAP has assigned CWE-862 and published remediation guidance via SAP Security Note 3799621.
Unauthenticated information disclosure in SAP NetWeaver Enterprise Portal allows remote attackers to bypass resource restrictions and retrieve non-critical application information, producing only a low confidentiality impact (CVSS 5.3). The issue is mapped to CWE-552 and tagged as path traversal, so exposed portals may leak reconnaissance-grade data rather than credentials or code execution. No public exploit identified at time of analysis; exposure is reduced when the portal is not internet-facing or is protected by a reverse proxy/WAF that filters traversal patterns.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal allows unauthenticated remote attackers to inject a malicious script into a URL parameter that is reflected back in the server response, where it executes in the browser of any portal user who opens the crafted link. Exploitation depends on user interaction (CVSS 3.1 base 6.1, MEDIUM, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and can result in theft of session information, manipulation of portal content, or redirection of the victim. No public exploit identified at time of analysis.
Command injection in SAP Yeoman UI (app-studio-toolkit) enables an attacker to execute arbitrary OS commands with the developer's privileges by crafting a malicious workspace settings.json that sets ApplicationWizard.installationLocation to a shell payload. The command fires when the developer triggers a generator installation or uninstallation, which invokes child_process.execSync with the unsanitized value. The assessed CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local exploitation requiring user interaction, with high impact to confidentiality, integrity, and availability on the developer workstation; no confirmed active exploitation or public exploit code is identified in the provided data.
Broken access control in SAP CLA Assistant lets any authenticated low-privilege user read the CLA signature records of an organisation they do not administer by supplying that organisation's ID to the admin API endpoint that retrieves signature records; the missing authorization check on the ID-based lookup path exposes contributor names and other signature metadata (CVSS 3.1 score 6.5, CWE-862 Missing Authorization, confidentiality-only impact). Exploitation requires a valid authenticated session with limited privileges and knowledge or enumeration of a valid organisation ID, so it is a targeted information-disclosure issue rather than an unauthenticated compromise. No public exploit identified at time of analysis, and no evidence of active exploitation.
Insufficient input validation in SAP UI5 allows an authenticated, low-privileged user to submit crafted content that is later rendered in another user's browser, producing a low-impact client-side injection (CVSS 4.4, Medium) that can affect the confidentiality and integrity of the victim's session but not availability. Exploitation is substantially constrained: the assessed vector (AV:N/AC:H/PR:L/UI:R/S:C) requires a valid low-privilege account, the application to be running in one of the specific non-default configurations where validation is inadequate, and a victim to actively open or render the view containing the attacker-supplied content. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exact vulnerable configuration is addressed in SAP Note 3799054.
Token trust-source confusion in SAP's cloud-security-services-integration-library lets the HybridTokenAuthenticator component accept identity tokens minted by an IAS/XSUAA service binding that was never intended as the application's trust source, resulting in unauthorized access at limited confidentiality and integrity impact (CVSS 3.1 base 4.2, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, no availability impact). Only deployments bound to multiple IAS/XSUAA service instances are exposed: an 'ambient' binding must exist for the flaw to trigger, and remote attackers must already hold a valid token issued by that ambient binding before they can authenticate, so single-binding SAP BTP Cloud Foundry applications are not affected. There is no public exploit identified at time of analysis, and all available signals point to a genuinely low-priority issue rather than an urgent one.
Cross-site scripting in applications based on SAP GUI for HTML on SAP NetWeaver Application Server ABAP lets an authenticated attacker (PR:L) inject malicious content through functionality that does not sufficiently sanitize user-supplied input, with the script executing in a second user's browser once that victim interacts with the poisoned content (UI:R). The flaw is rated CVSS 5.4 (CWE-79), with scope change and low confidentiality/integrity impact and no availability impact; SAP is the reporting vendor and has published Security Note 3671819. There is no public exploit identified at time of analysis and no CISA KEV listing, so this should be treated as a medium-severity, credentialed-to-credentialed escalation path rather than an internet-facing emergency.
DOM-based cross-site scripting in the SAPUI5 Support Assistant Overlay lets an unauthenticated attacker craft a publicly hosted link that, when opened by a logged-in SAP user, causes attacker-controlled input to be read by client-side code and written into the DOM without sanitization, executing script in that user's browser context. Exploitation is not automatic: it requires the Overlay component to be present and reachable plus user interaction (UI:R), so the attacker must socially engineer a specific authenticated victim into clicking the link. There is no public exploit identified at time of analysis and no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) with limited confidentiality and integrity impact on the victim's browser scope and no availability impact.
Stored cross-site scripting in SAP Manufacturing Integration and Intelligence (MII) lets an authenticated, low-privileged attacker persist malicious content that is later rendered and executed in the browser of an authenticated victim who opens the affected page. Scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires a valid low-privileged MII account to plant the payload plus victim navigation to the tainted page, so exploitation is limited to the victim's browser context: session information access, modified page content, and local disruption of the application, not server compromise. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Low-privileged attackers positioned on a network adjacent to an SAP Cloud Connector can extract limited information about internal systems by sending specially crafted requests that slip past a flawed authorization check. Exploitation carries a dual prerequisite - adjacency to the connector (AV:A, so not reachable from the public internet) plus valid low-privilege credentials (PR:L) - and the resulting impact is confined to low confidentiality loss with no effect on integrity or availability, which is why this is assessed as a genuinely low-priority issue despite being a real vulnerability at CVSS 3.5. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); no EPSS data was supplied with this report.
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input, so an unauthenticated attacker can craft a malicious link that, once clicked by a logged-in user, makes the victim's browser pull attacker-controlled content from an external location and potentially expose data from the active session, producing a high confidentiality impact with no effect on integrity or availability. The issue is network-reachable (AV:N) but requires specific crafting conditions (AC:H) plus victim interaction (UI:R), while the attacker needs no credentials (PR:N); the assessed base score is 5.3 (Medium) on vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. No public exploit code was identified at time of analysis, and the weakness class (CWE-95) points to injection into dynamically evaluated code rather than a default-configuration remote compromise, so the realistic risk is a targeted phishing-style data-theft attempt against authenticated launchpad users with sensitive in-session data.
SAPUI5's frame options allowlist feature insufficiently validates parent frame origins, enabling a framing-based social engineering attack against authenticated SAP users. An unauthenticated attacker can host a malicious page that embeds a SAPUI5 application in an iframe while bypassing the configured origin allowlist, then lure an authenticated victim into interacting with it to trigger unintended in-application actions. Impact is limited to low integrity - no confidentiality or availability consequences - and no public exploit or active exploitation (KEV) has been identified.
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day.
Unauthorized administrative interface access in SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server exposes sensitive system state to authenticated low-privileged users. Exploiting this flaw, an attacker with only a basic SAP account can query administrative endpoints normally restricted to higher-privilege roles, retrieving configuration details, system internals, or operational data that could serve as reconnaissance for follow-on attacks. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low authentication bar (any valid low-privilege account) and direct network accessibility make the exposure surface meaningful in enterprise SAP environments.
Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. Impact is confined to confidentiality at a low level; no public exploit or CISA KEV listing has been identified at time of analysis.
Insufficient authorization enforcement in SAP S/4HANA's Manage Bank Chains application allows an authenticated low-privileged user to delete bank chain records outside their permitted scope. The impact is strictly limited to availability - deletion of specific configuration entries - with no confidentiality or integrity exposure, yielding a CVSS 4.3 moderate rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craft a malicious link or page that, when interacted with by an authenticated victim, triggers unintended server-side actions on their behalf. The impact is limited to low-integrity and low-confidentiality effects with no availability impact, confirmed by SAP as part of Security Patch Day (Note 3371336). No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity.
Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected.
Transient CPU exhaustion in SAP Process Integration's SOAP Adapter allows a privileged authenticated user to craft SOAP requests containing deeply nested XML entity definitions (CWE-776, 'XML Bomb' class), temporarily degrading system responsiveness. The vulnerability scores CVSS 2.2, reflecting that exploitation requires high privileges, high attack complexity, and yields only low availability impact with zero confidentiality or integrity consequences. No public exploit code and no CISA KEV listing have been identified, placing this firmly in the low-priority tier despite network reachability.
SQL injection in SAP S/4HANA's Intercompany Matching and Reconciliation (ICR) module allows a low-privileged authenticated user to exfiltrate sensitive data from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard SAP user account, with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
DOM-based reflected Cross-Site Scripting in SAP NetWeaver Application Server ABAP enables an authenticated attacker to craft a malicious URL and distribute it to other authenticated SAP users. When a victim accesses the link, unsanitized input is reflected and executed within the DOM in the victim's browser, resulting in high confidentiality impact - such as session token or credential theft - and low integrity impact. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the high confidentiality component.
Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attackers to send specially crafted requests that bypass header sanitization, resulting in limited unauthorized information disclosure from internal backend components. All SAP Approuter Node.js package versions below 23.0.0 are affected, with a vendor-released patch available at version 23.0.0. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the zero-authentication requirement and low attack complexity make it accessible to opportunistic actors targeting exposed SAP BTP deployments.
Path traversal authorization bypass in SAP Approuter (Node.js package, versions prior to 23.0.0) enables a low-privileged authenticated attacker to send specially crafted requests that escape the Approuter's routing authorization controls and reach protected backend destinations beyond their assigned scope. Successful exploitation yields high confidentiality impact - exposure of sensitive backend data - and limited integrity impact through restricted modifications to protected resources, with no effect on availability. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by high attack complexity per the CVSS AC:H rating.
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privilege attacker to hijack another user's session by sending crafted requests that circumvent header integrity verification on certain code paths. Exploitation demands prior out-of-band observation of the target's session values, constraining this to determined, targeted attackers rather than opportunistic mass exploitation. No public exploit code and no CISA KEV listing identified at time of analysis, but successful exploitation yields full read access to the victim's session context with a high confidentiality impact per CVSS.
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.
Improper error condition handling in SAP Approuter (the node.js routing component of SAP Business AI Platform) allows a low-privileged network attacker to cause a partial availability disruption under a non-default configuration. The attack is highly complex, requiring conditions outside the attacker's control, and produces only low availability impact with no confidentiality or integrity loss. No public exploit has been identified at time of analysis, and a vendor patch is available in Approuter node.js package version 23.0.0 and later.
Open redirect exploitation in SAP's python-pyodata library (versions before 1.11.2) allows a malicious or compromised OData service to capture sensitive authentication information transmitted by the client and inject untrusted data into the consuming application. Applications using pyodata that connect to externally controlled or attacker-reachable OData endpoints are at risk of credential disclosure and data integrity compromise. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV, but a vendor-released patch is available at version 1.11.2.
SAP BusinessObjects Business Intelligence Platform (Admin Tools) fails to enforce authorization checks on certain administrative functions, allowing an authenticated low-privilege user to access restricted information. Affected versions include the 2025 release and ENTERPRISE 430. The flaw is classified as CWE-862 (Missing Authorization) and carries a CVSS 4.3 rating with no public exploit identified at time of analysis and no CISA KEV listing.
Stored cross-site scripting in SAPUI5's content adaptation feature allows a key user with content adaptation privileges to inject persistent malicious scripts into adapted application definitions. When any user subsequently opens the compromised adapted application, the injected script executes in their browser session, enabling session token theft and unauthorized actions on behalf of the victim. Affected versions span multiple SAPUI5 release tracks (754 through 816 and SAP_UI 750); no public exploit or CISA KEV listing has been identified at time of analysis.
SQL DDL injection in SAP Social Intelligence (versions 102-109) allows an authenticated low-privilege network attacker to directly execute Data Definition Language commands against the underlying database. Exploitation can alter or destroy database schema objects - a more structurally damaging capability than typical DML injection - with vendor-rated Low impact across confidentiality, integrity, and availability. No active exploitation confirmed at time of analysis and no public exploit identified; patch details are available via SAP Security Note 3766473.
Privilege escalation in SAP S/4HANA's Reprocess Bank Statement Items component allows authenticated users to invoke processing rules that have not been explicitly shared with them, circumventing intended access controls. Affected versions span S4CORE releases 104 through 109, covering a broad swath of actively supported SAP S/4HANA deployments. The impact is confined to low-severity information disclosure - unauthorized rule access reveals restricted bank statement logic - with no integrity or availability consequences; no public exploit or active exploitation has been identified at the time of analysis.
Unbounded memory growth in SAP Business AI Platform (Approuter) allows a low-privileged authenticated attacker to degrade availability by flooding the application with high-volume data while suppressing response consumption. The vulnerability stems from insufficient flow control, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). Confidentiality and integrity are unaffected; the impact is limited to availability, and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Certificate validation bypass in SAP Approuter node.js package (versions prior to 23.0.0) enables a low-privileged network attacker holding a certificate from the same trusted CA with matching subject values to impersonate trusted internal components during certain callback flows. The attack path is constrained by high complexity - the attacker must satisfy specific PKI prerequisites - but successful exploitation yields high integrity impact through component impersonation. No public exploit code or CISA KEV listing has been identified at time of analysis.
XML External Entity (XXE) injection in SAP BusinessObjects Business Intelligence (Web Intelligence) enables a low-privileged authenticated attacker to read arbitrary server-side files by uploading a crafted spreadsheet containing malicious external entity references and using it as a report data source. Affected versions span the 2025, 2027, ENTERPRISE 430, and ENTERPRISECLIENTTOOLS 430 release lines, all confirmed by ENISA EUVD-2026-55877 and SAP Note 3753141. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low authentication bar and high confidentiality impact make this a material risk for any enterprise running Web Intelligence.
Memory disclosure in SAP ABAP Platform exposes residual data from previously allocated memory buffers to unauthenticated remote attackers via a specially crafted request to an internal component. Affected deployments include ABAP Platform 7.54, KERNEL 7.53, KRNL64UC 7.53, and 7.77, with the vendor characterizing the leaked data as limited and non-sensitive. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, consistent with the moderate CVSS 5.3 rating reflecting low confidentiality impact with no integrity or availability consequences.
Hardcoded credentials embedded in SAP Advanced Planning and Optimization (Model Mix Planning) source code enable authenticated high-privilege attackers to bypass the application's authorization layer and delete specific planning-related restrictions. Confirmed by SAP via Security Note 3763028 and disclosed on SAP Security Patch Day, the flaw spans a wide range of APO versions including SCM 700, S4CORE, and S4COREOP release lines. No public exploit code exists and the vulnerability is not listed in CISA KEV; real-world impact is constrained by the high-privilege prerequisite and limited to low-severity confidentiality and integrity effects.
Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows any low-privileged authenticated user to access user account information that is intended to be restricted to privileged roles. The exposed account data - names, identifiers, or contact details of privileged users - can directly enable targeted follow-on attacks such as spear phishing or credential stuffing against identified administrator accounts. No public exploit code or active exploitation has been identified at time of analysis; CVSS 3.1 rates this Medium (4.3) with low confidentiality impact and no integrity or availability impact.
Unauthorized configuration table modification in SAP NetWeaver and ABAP Platform's Change and Transport System (CTS) Customer Transport Integration Wizard allows a low-privileged authenticated user to alter access controls for data objects during specific wizard operations. Affected SAP_BASIS releases span from 740 through 816, covering a broad range of enterprise SAP landscapes. The practical impact is limited to processing delays and operational disruption (low integrity and availability), with no confidentiality exposure; no public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog.
Tenant context spoofing in SAP Approuter (node.js package < 23.0.0) allows unauthenticated remote attackers to craft requests that bypass tenant isolation, resulting in limited cross-tenant information disclosure. Exploitation is constrained by High Attack Complexity (AC:H per vendor CVSS), meaning conditions necessary for success are not fully under attacker control. No public exploit has been identified at time of analysis and a vendor patch is available, making this a low-urgency but compliance-relevant issue for SAP BTP multi-tenant deployments.
Denial-of-service in SAP Approuter (SAP Business AI Platform), the node.js routing and authentication gateway for SAP BTP applications, allows remote unauthenticated attackers to crash and restart the component by sending specially crafted input under specific runtime conditions. All versions of the SAP Approuter node.js package prior to 23.0.0 are affected, with high availability impact and no confidentiality or integrity exposure. No public exploit has been identified at time of analysis, and SAP has released a patch via Security Note 3786038.
Insufficient authorization enforcement in the WebSocket layer of SAP Approuter (node.js package < 23.0.0) allows a low-privileged authenticated attacker to reach functionality that should be access-controlled. Successful exploitation yields high confidentiality impact - exposure of sensitive data routed through the Approuter - and limited data modification capability, with no effect on availability. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, a vendor-released patch is available and should be prioritized for SAP BTP environments.
OS command injection in SAP NetWeaver Application Server ABAP and ABAP Platform enables an attacker holding high-privilege credentials to bypass missing security controls on an internal ABAP code path and execute arbitrary commands on the underlying operating system. Affected releases span kernel versions 7.22 through 9.16, placing a broad range of production SAP landscapes at risk of service disruption or unauthorized OS-level writes. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the high availability impact (A:H) makes it a meaningful patch priority for SAP Basis teams.
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stack-based buffer overflow in SAP SAPSPrint Service (CWE-121) allows unauthenticated remote attackers to crash the service via specially crafted command requests, triggering an automatic service restart. The impact is limited to low availability disruption with no confidentiality or integrity compromise. No public exploit code or active exploitation has been identified at time of analysis, and SAP has addressed this vulnerability via their Security Patch Day cycle.
CSS stylesheet injection in SAP @ui5/webcomponents-base allows unauthenticated remote attackers to load arbitrary cross-origin stylesheets into victim pages by bypassing the sap-allowed-theme-origins allowlist enforcement inside setThemeRoot(). The ?sap-themeRoot URL query parameter is a direct delivery vector, making socially-engineered exploitation trivial - no authentication is required from the attacker (CVSS PR:N), only a victim page load (UI:R). Successful exploitation enables UI redressing, clickjacking, phishing overlays, visual defacement, and limited CSS attribute-selector-based data exfiltration; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Privilege escalation in SAP S/4HANA's Draft Operation component allows authenticated restricted users to read entity data beyond their authorized scope due to missing authorization checks. The flaw, classified under CWE-862, is exploitable over the network without elevated privileges, resulting in low confidentiality impact with no effect on integrity or availability. No public exploit code or active exploitation has been identified at time of analysis, keeping real-world risk bounded despite the network-accessible attack vector.
Missing authorization in SAP S/4HANA's Create Single Payment function exposes restricted entity set keys to authenticated but low-privileged users. The flaw (CWE-862) allows a restricted user to query specific payment-related entity sets beyond their intended access scope, resulting in low-impact confidentiality leakage with no effect on data integrity or system availability. No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS data was not provided, but the CVSS 4.3 medium score and limited impact scope suggest low exploitation urgency.
SQL injection in SAP S/4HANA Project Management (PPM-PRO) allows a high-privileged authenticated attacker to execute crafted database queries, exposing backend database contents. The vulnerability is reachable over the network but requires both high attack complexity and high privilege level, significantly constraining the realistic attacker pool. No public exploit or active exploitation has been identified at time of analysis, and the CVSS base score of 5.5 reflects these mitigating factors despite the potential for database exposure.
Script injection in SAP CRM WebClient UI is enabled by absent Content Security Policy (CSP) directives for certain restrictive headers, allowing an authenticated low-privileged attacker to inject malicious JavaScript that executes in a victim user's browser session. The CVSS vector (PR:L/UI:R/S:C) confirms this requires both an authenticated attacker and victim interaction, with a cross-scope impact consistent with browser-context script execution. No public exploit code or CISA KEV active exploitation listing has been identified at time of analysis, and impact is bounded to low integrity with no confidentiality or availability consequence.
Reflected XSS in SAP NetWeaver Application Server ABAP's Business Server Pages (BSP) framework allows remote unauthenticated attackers to inject arbitrary JavaScript into HTTP responses when a victim user interacts with a crafted URL. Successful exploitation enables session token theft and execution of authenticated actions on behalf of the victim within the SAP web context. No public exploit code or CISA KEV listing is identified at time of analysis; CVSS AC:H indicates non-trivial conditions must align for successful delivery, moderating real-world risk despite the enterprise sensitivity of SAP environments.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal enables unauthenticated remote attackers to inject arbitrary JavaScript into URL parameters that are echoed back unencoded in server responses. When a victim with an active portal session visits a crafted URL, the injected script executes in their browser under the portal's origin, permitting session token theft, unauthorized manipulation of portal content, or forced redirection to attacker-controlled resources. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the unauthenticated network-accessible attack surface and low complexity make phishing-based delivery operationally straightforward.