SAP
Monthly
An authorization bypass in SAP ABAP Platform lets a low-privileged, authenticated user open the session manager in single transaction mode - including through the Fiori Launchpad (FLP) - and then send crafted requests that defeat restrictions the platform had previously enforced correctly. The weakness is a regression: an underlying SAP API change reintroduced a flaw that had already been fixed, so only ABAP Platform deployments carrying that regressed API (and not yet covered by SAP Note 3626303) are exposed. Impact is rated 7.1 with high integrity and low confidentiality consequences and no availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N); valid low-privilege credentials are mandatory, so this is an authenticated privilege-escalation-style issue rather than a pre-auth intrusion path, and no public exploit identified at time of analysis.
SQL injection in SAP Commerce Cloud lets an authenticated user with only low-level privileges (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) inject arbitrary SQL through specially crafted requests into the affected out-of-the-box functionality, with the potential to read, modify or delete sensitive application database data and therefore high confidentiality, integrity and availability impact. The flaw is CWE-89 in code delivered as part of SAP Commerce Cloud itself, meaning it is not confined to a customer's custom extensions, but the advisory does not name the exact endpoint or parameter, so the precise injectable surface is not confirmed from available data. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only real precondition is obtaining a valid authenticated session, which is a low barrier for deployments that allow customer self-registration or maintain numerous back-office accounts. This is a genuine high-priority vulnerability, though not an emergency.
Server-side request forgery in the SAP Cloud SDK for Python lets remote, unauthenticated attackers redirect OAuth2 token requests to a server they control by manipulating the tenant_subdomain value used to build the token endpoint URL, resulting in exfiltration of the application's OAuth2 client credentials. Exposure is limited to multi-tenant SAP BTP applications that use the SDK for OAuth2 token acquisition and allow attacker influence over the tenant_subdomain input; single-tenant deployments, or those that do not derive the token URL from attacker-supplied data, are not exposed. The vulnerability carries a maximum-severity score of CVSS 10.0, and no public exploit code was identified at time of analysis; no confirmed actively exploited (CISA KEV) status applies.
SAP NetWeaver Visual Composer fails to enforce sufficient authorization checks within certain portal functionality, allowing a low-privileged authenticated user to invoke internal operations against a preconfigured remote system; depending on how that remote connection is configured, the attacker could fully compromise the destination system, with high impact on confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting the scope change that carries impact from the vulnerable portal into the connected remote system. Exploitation requires a valid low-privileged portal session (not anonymous access) plus an existing preconfigured remote destination reachable through Visual Composer, and there is currently no public exploit identified at time of analysis.
SAP MII's administrative account-provisioning function fails to enforce proper authorization boundaries, enabling an attacker who already holds MII administrator privileges to craft a request that provisions an account with elevated privileges on the underlying Java application server. This can extend compromise beyond MII to the host, with high confidentiality, integrity, and availability impact, and is reflected in a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in SAP S/4HANA's Manage Substitution/Validation Rules allows an authenticated attacker who already holds rule-maintenance business authorizations to submit crafted rule definitions that the rule-processing logic interprets as executable ABAP, resulting in full compromise of the affected system with high impact to confidentiality, integrity and availability (CVSS 9.9, Scope:Changed). Reaching the vulnerable code path requires an account provisioned with substitution/validation rule creation or maintenance privileges, so the practical barrier is authorization scope rather than authentication alone. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory (SAP Security Note 3805589) should be treated as urgent given the code-injection primitive and the privileged business role required.
Unauthenticated remote denial of service affects SAP NetWeaver and SAP Web Dispatcher deployments in which the Internet Communication Manager (ICM) internal protocol component can be reached by an attacker; a specially crafted request carrying invalid field values triggers an integer underflow (CWE-191) that corrupts memory handling and crashes the affected process. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning any network-reachable instance is exposed with no credentials or user interaction required, but the consequence is strictly service disruption - there is no confidentiality or integrity impact and no demonstrated path to data disclosure, tampering, or code execution. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the practical risk driver is therefore exposure of the ICM/Web Dispatcher protocol endpoint rather than active exploitation, with internet-facing systems materially more at risk than segmented internal ones.
Stored cross-site scripting in the Capture Validation application of OpenText Vendor Invoice Management for SAP Solutions allows a high-privileged authenticated user to persist malicious script content that later executes in another user's browser when the affected view is opened, potentially exposing or altering invoice data processed by the application. The vendor rates the issue 7.3, while our independent assessment places it at moderate severity (CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) because exploitation requires privileged access to plant the payload, victim interaction to trigger it, and an additional unspecified application condition per the vendor's 'under certain conditions' qualifier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
A buffer overflow in the Linux kernel's iwlwifi MEI coexistence code (iwlmei) lets a party able to inject SAP messages over the MEI bus trigger an out-of-bounds memory write by declaring a message length larger than the driver's local buffer, which the code reads without validating. Affected systems are limited to kernels built with CONFIG_IWLMEI on Intel hardware where CSME/AMT coexists with the Wi-Fi device - a non-default, enterprise-oriented configuration; standard iwlwifi deployments are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the flaw is remotely reachable only from a compromised CSME/ME firmware or equivalent MEI-side attacker, so the practical prerequisites are substantial even though the vendor score of 8.4 (AV:L/AC:L/PR:N) overstates ease of reach. Vendor-released fixes are available in 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1.
Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis.
Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw.
Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis.
Session hijacking in SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated remote attacker to assume another authenticated user's session by exploiting an integer underflow that causes a previously buffered request to be reprocessed in the wrong connection context. The attack is constrained by a narrow race-condition timing window requiring a victim session to be in a buffered state simultaneously, limiting mass exploitation but not targeted attacks against high-value SAP landscapes. Successful exploitation yields high confidentiality and integrity impact consistent with full session takeover; no public exploit code or active exploitation has been identified at time of analysis.
Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle.
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote users to read arbitrary files from the server filesystem or conduct server-side request forgery against internal network resources. Affected releases span App Connect Enterprise 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. The CVSS scope-change flag (S:C) reflects that a successful XXE can pivot beyond the integration engine itself into adjacent internal infrastructure. No public exploit has been identified at time of analysis, and IBM has released a patch.
Regular Expression Denial of Service in SAP S/4HANA (Private Cloud) allows unauthenticated remote attackers to exhaust server resources by supplying specially crafted input to a network-accessible endpoint that invokes a vulnerable third-party regex component (CWE-1333). Successful exploitation causes high availability impact with no confidentiality or integrity exposure, making this a targeted disruption risk against a critical ERP platform. No active exploitation has been confirmed - the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.
SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. No public exploit or active exploitation has been identified at time of analysis, but the CVSS scope change (S:C) signals that successfully decrypted credentials can be used to compromise systems beyond the BI platform itself.
Missing authorization checks in SAP ABAP Developer Tools (the Eclipse-based IDE for ABAP development) allow any low-privileged SAP user to execute unauthorized database operations against SAP NetWeaver AS ABAP backends. The flaw spans a wide range of SAP_BASIS releases (750 through 920) and yields full confidentiality, integrity, and availability compromise of the ABAP application layer - including the ability to read sensitive business data, modify application records, and disrupt legitimate user access. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage elevate real-world risk considerably for enterprises running ADT-connected NetWeaver systems.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible due to a missing authorization check on scheduling-related API endpoints. Any network-reachable attacker without credentials can retrieve, create, modify, or delete scheduling data managed by the application, impacting confidentiality, integrity, and availability at a low severity level each. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions - no authentication, no user interaction, low complexity - lower the barrier to opportunistic abuse significantly.
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend operations to unauthenticated remote attackers via crafted HTTP requests with specific parameter values. Successful exploitation grants read, create, modify, and delete access to application-managed business data, producing a limited but tripartite impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at this time, though the zero-privilege network vector lowers the bar for opportunistic probing.
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outside intended directory boundaries by supplying specially crafted input to affected file path validation functions. Exploitation requires a legitimate user to subsequently interact with the attacker-influenced content and depends on conditions outside the attacker's direct control, as reflected by the AC:H and UI:R CVSS metrics. Successful exploitation achieves a scope change affecting adjacent components with high impact on confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing exist at time of analysis.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Insecure deserialization in the SAP Change and Transport System Attach Tool (ctsattach) lets an authenticated, low-privileged attacker achieve remote code execution by supplying a crafted archive that a victim then processes through the tool's library. Successful exploitation yields high confidentiality and integrity impact - attackers can read sensitive data and take control of the host and its processes - with low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause and 7.6 CVSS make this a meaningful patch priority for SAP landscapes.
Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed.
Reflected cross-site scripting in SAP NetWeaver Application Server Java (specifically the Configuration Wizard component) lets an unauthenticated attacker embed malicious JavaScript in crafted URLs that executes in a victim's browser when the link is opened. Because the CVSS scope is changed (S:C) and confidentiality impact is high, a successful lure can expose sensitive session information and tamper with non-sensitive data rendered in the client. No public exploit identified at time of analysis, but the 8.2 CVSS and unauthenticated, network-reachable vector make it a meaningful phishing-driven risk for exposed SAP portals.
Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack.
Unauthorized access in SAP Approuter arises because the component fails to validate incoming request headers during the OAuth2 login flow under certain configurations (CWE-601, open redirect). An unauthenticated remote attacker who lures a victim into clicking a crafted link can hijack the authentication flow to gain high-confidentiality and high-integrity access to the application. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, low-complexity nature (CVSS 8.1) makes it a meaningful patch priority for SAP BTP/Cloud Foundry environments.
Request-response desynchronization in SAP Approuter lets an unauthenticated remote attacker send a specially crafted HTTP request that smuggles a second request past the front end, allowing exposure of other users' HTTP responses and denial of service against the application. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) and was reported by SAP; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Signed XML message tampering in SAP NetWeaver Application Server ABAP and ABAP Platform allows authenticated low-privileged attackers to forge identity information by capturing a valid signed message and submitting modified signed XML documents that the verifier accepts. The scope-changing flaw (CVSS 9.9) enables unauthorized access to sensitive user data and disruption of normal operations across trust boundaries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Path traversal in SAP NetWeaver Application Server Java's Web Container allows unauthenticated remote attackers to manipulate file inclusion parameters within crafted HTTP logon requests, leading to inclusion and processing of arbitrary local files. Successful exploitation can expose or modify sensitive data and render portions of the server unavailable, with no public exploit identified at time of analysis but a CVSS of 9.0 reflecting full CIA impact with scope change.
Unauthenticated remote memory corruption in the SAP Kernel of SAP NetWeaver Application Server ABAP and ABAP Platform allows attackers to compromise confidentiality, integrity, and availability by sending crafted RFC requests that trigger logical errors in memory management. The CVSS 9.8 score reflects network-reachable, no-privileges, no-interaction exploitation against a foundational SAP component, though no public exploit identified at time of analysis and exploitation status beyond the vendor disclosure is not confirmed in CISA KEV.
Arbitrary server-side code execution in SAP Commerce Cloud via unauthenticated malicious configuration upload and code injection. Attackers can remotely exploit a misconfigured Spring Security framework to upload crafted configuration files and inject code without authentication, requiring only that a user interact with malicious content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). The vulnerability affects SAP Commerce Cloud Configuration with critical impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, though EPSS data unavailable. Patch details available in SAP Security Note 3733064.
SQL injection in SAP S/4HANA Enterprise Search for ABAP allows authenticated attackers to extract sensitive database information and crash the application via malicious SQL statements injected through improperly validated user input. The scope change (S:C) indicates potential lateral movement beyond the vulnerable component. SAP has released security patches (SAP Note 3724838) for this critical vulnerability with CVSS 9.6. No active exploitation confirmed at time of analysis, though the authentication bypass tag suggests potential credential bypass implications.
OS command injection in SAP Forecasting & Replenishment allows authenticated administrators to execute arbitrary system commands through abuse of a non-remote-enabled function, leading to complete system compromise. The vulnerability enables full read/write access to system data and potential system shutdown, though exploitation is constrained to local attack vectors and requires high-privilege administrative access (CVSS 8.2). No public exploit code or active exploitation confirmed at time of analysis, with vendor patch available via SAP Security Patch Day.
SQL injection in SAP Business Planning and Consolidation (BPC) and SAP Business Warehouse (BW) allows authenticated users to execute arbitrary SQL commands against the database. Affected versions span SAP_BW 750-758, BPC4HANA 300, and HANABPC 810/816. The scope-change vector (S:C) indicates attackers can pivot beyond the vulnerable component to compromise database resources serving multiple SAP applications. Despite critical CVSS 9.9 severity, EPSS exploitation probability remains low (0.05%, 14th percentile) with CISA SSVC indicating no current exploitation and non-automatable attack profile. SAP security note 3719353 provides remediation guidance.
Authenticated remote attackers can overwrite eight-character executable ABAP reports in SAP ERP and SAP S/4HANA systems due to missing authorization checks, enabling denial-of-service conditions when legitimate users execute corrupted reports. This authorization bypass (CWE-862) requires low-privilege authenticated access (CVSS PR:L) and has low attack complexity, combining limited integrity impact with high availability impact (CVSS 7.1). EPSS data not provided; no public exploit identified at time of analysis. Affects SAP ERP and SAP S/4HANA Private Cloud and On-Premise deployments.
SAP NetWeaver Enterprise Portal Administration has an insecure deserialization vulnerability allowing privileged users to execute code through uploaded files.
Authenticated users in SAP Solution Tools Plug-In (ST-PI) can access sensitive information through a function module that lacks proper authorization controls, allowing disclosure of confidential data without requiring additional privileges. The vulnerability affects all users with basic authentication to the affected SAP systems, as the missing checks permit lateral data exposure across the application.
Denial-of-service vulnerability in SAP Advanced Planning And Optimization and Supply Chain Management allows authenticated users to exhaust system resources by repeatedly calling a remote function module with oversized parameters, causing service unavailability. An attacker with standard user credentials and network access can trigger prolonged resource consumption that may render the affected system unresponsive. No patch is currently available.
Sap Basis versions up to 700 is affected by improper verification of cryptographic signature (CVSS 8.8).
Unauthorized Remote Function Call execution in SAP NetWeaver ABAP. Low-privileged users can execute background RFCs without proper authorization checks. CVSS 9.6.
Businessobjects Business Intelligence Platform versions up to 430 is affected by url redirection to untrusted site (open redirect) (CVSS 7.3).
Businessobjects Business Intelligence Platform versions up to 430 is affected by missing authorization (CVSS 7.5).
Unauthorized code execution in SAP CRM and SAP S/4HANA Scripting Editor. Authenticated attacker exploits generic function module call to execute unauthorized ABAP code. CVSS 9.9.
Businessobjects Business Intelligence Platform versions up to 430 contains a security vulnerability (CVSS 7.5).
SAP Fiori App Intercompany Balance Reconciliation fails to enforce proper authorization controls, allowing authenticated users to escalate privileges and access or modify sensitive data they should not have permission to view. An attacker with valid credentials can exploit missing access checks to compromise the confidentiality and integrity of financial reconciliation data. No patch is currently available for this vulnerability.
SAP Application Server for ABAP and NetWeaver RFCSDK contain an OS command injection vulnerability that allows authenticated administrators with adjacent network access to execute arbitrary system commands by uploading malicious content. Successful exploitation results in complete system compromise affecting confidentiality, integrity, and availability. No patch is currently available.
Netweaver Application Server Abap versions up to 700 is affected by missing authorization (CVSS 8.1).
SAP S/4HANA General Ledger (Private Cloud and On-Premise) has SQL injection allowing authenticated users to read, modify, and delete backend database data with scope change (CVSS 9.9). Financial data is directly at risk.
SAP Wily Introscope Enterprise Manager uses a vulnerable third-party component that allows unauthenticated attackers to create malicious JNLP files at public URLs. Victims who click these URLs execute OS commands on their machines. Scope change. Patch available.
SAP S/4HANA (Private Cloud and On-Premise) has the same backdoor vulnerability as CVE-2026-0491 – admin-exploitable ABAP/OS command injection via RFC function module. Patch available.
Hana Database versions up to 2.00 is affected by missing authentication for critical function (CVSS 8.8).
SAP Landscape Transformation has an admin-exploitable backdoor via RFC function module that allows injection of arbitrary ABAP code and OS commands, bypassing authorization checks. Scope change enables full SAP system compromise.
SAP NetWeaver Visual Composer allows privileged users to upload untrusted content that is deserialized on the server, enabling remote code execution. Companion to CVE-2025-31324.
Unauthenticated remote code execution in SAP NetWeaver Visual Composer (Metadata Uploader component) allows attackers to upload arbitrary executable binaries to the host without any authentication, leading to full system compromise. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and Onapsis and multiple outlets report opportunistic attacks against internet-exposed NetWeaver Application Server Java systems. Its 97th-percentile EPSS (32.16%) and 9.8 CVSS underline it as a top-priority, mass-exploitable vulnerability.
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory". Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote unauthenticated code execution in SAP NetWeaver Application Server Java (pre-7.3) through the Invoker Servlet allows attackers to bypass authentication and execute arbitrary code. Confirmed actively exploited (CISA KEV) from 2013 through 2016 in 'Detour' attacks targeting SAP business applications. CVSS 10.0 with EPSS 16.90% (95th percentile) indicates both maximum theoretical severity and sustained real-world exploitation. This remains a critical priority for organizations running legacy SAP NetWeaver Java instances despite the vulnerability's age.
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 77.7%.
Open redirect in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, enabling user-information tracking and page defacement. The vulnerability requires user interaction (UI:R) and results in low confidentiality and integrity impact with no availability impact, yielding a CVSS score of 6.1. No public exploit code has been identified at time of analysis.
Improper authorization checks in SAP S/4HANA's Linear Asset Management RAP business object allow an authenticated, low-privilege user with local/interactive access to modify associated business object data for which they lack authorization, producing a high integrity impact with no confidentiality or availability impact (CVSS 4.7). Exploitation requires high attack complexity and specific runtime or data-association conditions, and no remote or unauthenticated path is described; no public exploit identified at time of analysis. SAP has assigned CWE-862 and published remediation guidance via SAP Security Note 3799621.
Unauthenticated information disclosure in SAP NetWeaver Enterprise Portal allows remote attackers to bypass resource restrictions and retrieve non-critical application information, producing only a low confidentiality impact (CVSS 5.3). The issue is mapped to CWE-552 and tagged as path traversal, so exposed portals may leak reconnaissance-grade data rather than credentials or code execution. No public exploit identified at time of analysis; exposure is reduced when the portal is not internet-facing or is protected by a reverse proxy/WAF that filters traversal patterns.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal allows unauthenticated remote attackers to inject a malicious script into a URL parameter that is reflected back in the server response, where it executes in the browser of any portal user who opens the crafted link. Exploitation depends on user interaction (CVSS 3.1 base 6.1, MEDIUM, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and can result in theft of session information, manipulation of portal content, or redirection of the victim. No public exploit identified at time of analysis.
Insufficient input validation in SAP UI5 allows an authenticated, low-privileged user to submit crafted content that is later rendered in another user's browser, producing a low-impact client-side injection (CVSS 4.4, Medium) that can affect the confidentiality and integrity of the victim's session but not availability. Exploitation is substantially constrained: the assessed vector (AV:N/AC:H/PR:L/UI:R/S:C) requires a valid low-privilege account, the application to be running in one of the specific non-default configurations where validation is inadequate, and a victim to actively open or render the view containing the attacker-supplied content. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exact vulnerable configuration is addressed in SAP Note 3799054.
Token trust-source confusion in SAP's cloud-security-services-integration-library lets the HybridTokenAuthenticator component accept identity tokens minted by an IAS/XSUAA service binding that was never intended as the application's trust source, resulting in unauthorized access at limited confidentiality and integrity impact (CVSS 3.1 base 4.2, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, no availability impact). Only deployments bound to multiple IAS/XSUAA service instances are exposed: an 'ambient' binding must exist for the flaw to trigger, and remote attackers must already hold a valid token issued by that ambient binding before they can authenticate, so single-binding SAP BTP Cloud Foundry applications are not affected. There is no public exploit identified at time of analysis, and all available signals point to a genuinely low-priority issue rather than an urgent one.
Cross-site scripting in applications based on SAP GUI for HTML on SAP NetWeaver Application Server ABAP lets an authenticated attacker (PR:L) inject malicious content through functionality that does not sufficiently sanitize user-supplied input, with the script executing in a second user's browser once that victim interacts with the poisoned content (UI:R). The flaw is rated CVSS 5.4 (CWE-79), with scope change and low confidentiality/integrity impact and no availability impact; SAP is the reporting vendor and has published Security Note 3671819. There is no public exploit identified at time of analysis and no CISA KEV listing, so this should be treated as a medium-severity, credentialed-to-credentialed escalation path rather than an internet-facing emergency.
Stored cross-site scripting in SAP Manufacturing Integration and Intelligence (MII) lets an authenticated, low-privileged attacker persist malicious content that is later rendered and executed in the browser of an authenticated victim who opens the affected page. Scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires a valid low-privileged MII account to plant the payload plus victim navigation to the tainted page, so exploitation is limited to the victim's browser context: session information access, modified page content, and local disruption of the application, not server compromise. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Low-privileged attackers positioned on a network adjacent to an SAP Cloud Connector can extract limited information about internal systems by sending specially crafted requests that slip past a flawed authorization check. Exploitation carries a dual prerequisite - adjacency to the connector (AV:A, so not reachable from the public internet) plus valid low-privilege credentials (PR:L) - and the resulting impact is confined to low confidentiality loss with no effect on integrity or availability, which is why this is assessed as a genuinely low-priority issue despite being a real vulnerability at CVSS 3.5. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); no EPSS data was supplied with this report.
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input, so an unauthenticated attacker can craft a malicious link that, once clicked by a logged-in user, makes the victim's browser pull attacker-controlled content from an external location and potentially expose data from the active session, producing a high confidentiality impact with no effect on integrity or availability. The issue is network-reachable (AV:N) but requires specific crafting conditions (AC:H) plus victim interaction (UI:R), while the attacker needs no credentials (PR:N); the assessed base score is 5.3 (Medium) on vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. No public exploit code was identified at time of analysis, and the weakness class (CWE-95) points to injection into dynamically evaluated code rather than a default-configuration remote compromise, so the realistic risk is a targeted phishing-style data-theft attempt against authenticated launchpad users with sensitive in-session data.
SAPUI5's frame options allowlist feature insufficiently validates parent frame origins, enabling a framing-based social engineering attack against authenticated SAP users. An unauthenticated attacker can host a malicious page that embeds a SAPUI5 application in an iframe while bypassing the configured origin allowlist, then lure an authenticated victim into interacting with it to trigger unintended in-application actions. Impact is limited to low integrity - no confidentiality or availability consequences - and no public exploit or active exploitation (KEV) has been identified.
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day.
Unauthorized administrative interface access in SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server exposes sensitive system state to authenticated low-privileged users. Exploiting this flaw, an attacker with only a basic SAP account can query administrative endpoints normally restricted to higher-privilege roles, retrieving configuration details, system internals, or operational data that could serve as reconnaissance for follow-on attacks. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low authentication bar (any valid low-privilege account) and direct network accessibility make the exposure surface meaningful in enterprise SAP environments.
Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. Impact is confined to confidentiality at a low level; no public exploit or CISA KEV listing has been identified at time of analysis.
Insufficient authorization enforcement in SAP S/4HANA's Manage Bank Chains application allows an authenticated low-privileged user to delete bank chain records outside their permitted scope. The impact is strictly limited to availability - deletion of specific configuration entries - with no confidentiality or integrity exposure, yielding a CVSS 4.3 moderate rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craft a malicious link or page that, when interacted with by an authenticated victim, triggers unintended server-side actions on their behalf. The impact is limited to low-integrity and low-confidentiality effects with no availability impact, confirmed by SAP as part of Security Patch Day (Note 3371336). No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity.
Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected.
Transient CPU exhaustion in SAP Process Integration's SOAP Adapter allows a privileged authenticated user to craft SOAP requests containing deeply nested XML entity definitions (CWE-776, 'XML Bomb' class), temporarily degrading system responsiveness. The vulnerability scores CVSS 2.2, reflecting that exploitation requires high privileges, high attack complexity, and yields only low availability impact with zero confidentiality or integrity consequences. No public exploit code and no CISA KEV listing have been identified, placing this firmly in the low-priority tier despite network reachability.
An authorization bypass in SAP ABAP Platform lets a low-privileged, authenticated user open the session manager in single transaction mode - including through the Fiori Launchpad (FLP) - and then send crafted requests that defeat restrictions the platform had previously enforced correctly. The weakness is a regression: an underlying SAP API change reintroduced a flaw that had already been fixed, so only ABAP Platform deployments carrying that regressed API (and not yet covered by SAP Note 3626303) are exposed. Impact is rated 7.1 with high integrity and low confidentiality consequences and no availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N); valid low-privilege credentials are mandatory, so this is an authenticated privilege-escalation-style issue rather than a pre-auth intrusion path, and no public exploit identified at time of analysis.
SQL injection in SAP Commerce Cloud lets an authenticated user with only low-level privileges (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) inject arbitrary SQL through specially crafted requests into the affected out-of-the-box functionality, with the potential to read, modify or delete sensitive application database data and therefore high confidentiality, integrity and availability impact. The flaw is CWE-89 in code delivered as part of SAP Commerce Cloud itself, meaning it is not confined to a customer's custom extensions, but the advisory does not name the exact endpoint or parameter, so the precise injectable surface is not confirmed from available data. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only real precondition is obtaining a valid authenticated session, which is a low barrier for deployments that allow customer self-registration or maintain numerous back-office accounts. This is a genuine high-priority vulnerability, though not an emergency.
Server-side request forgery in the SAP Cloud SDK for Python lets remote, unauthenticated attackers redirect OAuth2 token requests to a server they control by manipulating the tenant_subdomain value used to build the token endpoint URL, resulting in exfiltration of the application's OAuth2 client credentials. Exposure is limited to multi-tenant SAP BTP applications that use the SDK for OAuth2 token acquisition and allow attacker influence over the tenant_subdomain input; single-tenant deployments, or those that do not derive the token URL from attacker-supplied data, are not exposed. The vulnerability carries a maximum-severity score of CVSS 10.0, and no public exploit code was identified at time of analysis; no confirmed actively exploited (CISA KEV) status applies.
SAP NetWeaver Visual Composer fails to enforce sufficient authorization checks within certain portal functionality, allowing a low-privileged authenticated user to invoke internal operations against a preconfigured remote system; depending on how that remote connection is configured, the attacker could fully compromise the destination system, with high impact on confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting the scope change that carries impact from the vulnerable portal into the connected remote system. Exploitation requires a valid low-privileged portal session (not anonymous access) plus an existing preconfigured remote destination reachable through Visual Composer, and there is currently no public exploit identified at time of analysis.
SAP MII's administrative account-provisioning function fails to enforce proper authorization boundaries, enabling an attacker who already holds MII administrator privileges to craft a request that provisions an account with elevated privileges on the underlying Java application server. This can extend compromise beyond MII to the host, with high confidentiality, integrity, and availability impact, and is reflected in a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote code execution in SAP S/4HANA's Manage Substitution/Validation Rules allows an authenticated attacker who already holds rule-maintenance business authorizations to submit crafted rule definitions that the rule-processing logic interprets as executable ABAP, resulting in full compromise of the affected system with high impact to confidentiality, integrity and availability (CVSS 9.9, Scope:Changed). Reaching the vulnerable code path requires an account provisioned with substitution/validation rule creation or maintenance privileges, so the practical barrier is authorization scope rather than authentication alone. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory (SAP Security Note 3805589) should be treated as urgent given the code-injection primitive and the privileged business role required.
Unauthenticated remote denial of service affects SAP NetWeaver and SAP Web Dispatcher deployments in which the Internet Communication Manager (ICM) internal protocol component can be reached by an attacker; a specially crafted request carrying invalid field values triggers an integer underflow (CWE-191) that corrupts memory handling and crashes the affected process. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning any network-reachable instance is exposed with no credentials or user interaction required, but the consequence is strictly service disruption - there is no confidentiality or integrity impact and no demonstrated path to data disclosure, tampering, or code execution. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the practical risk driver is therefore exposure of the ICM/Web Dispatcher protocol endpoint rather than active exploitation, with internet-facing systems materially more at risk than segmented internal ones.
Stored cross-site scripting in the Capture Validation application of OpenText Vendor Invoice Management for SAP Solutions allows a high-privileged authenticated user to persist malicious script content that later executes in another user's browser when the affected view is opened, potentially exposing or altering invoice data processed by the application. The vendor rates the issue 7.3, while our independent assessment places it at moderate severity (CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) because exploitation requires privileged access to plant the payload, victim interaction to trigger it, and an additional unspecified application condition per the vendor's 'under certain conditions' qualifier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
A buffer overflow in the Linux kernel's iwlwifi MEI coexistence code (iwlmei) lets a party able to inject SAP messages over the MEI bus trigger an out-of-bounds memory write by declaring a message length larger than the driver's local buffer, which the code reads without validating. Affected systems are limited to kernels built with CONFIG_IWLMEI on Intel hardware where CSME/AMT coexists with the Wi-Fi device - a non-default, enterprise-oriented configuration; standard iwlwifi deployments are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the flaw is remotely reachable only from a compromised CSME/ME firmware or equivalent MEI-side attacker, so the practical prerequisites are substantial even though the vendor score of 8.4 (AV:L/AC:L/PR:N) overstates ease of reach. Vendor-released fixes are available in 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6 and 7.3-rc1.
Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis.
Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw.
Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis.
Session hijacking in SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated remote attacker to assume another authenticated user's session by exploiting an integer underflow that causes a previously buffered request to be reprocessed in the wrong connection context. The attack is constrained by a narrow race-condition timing window requiring a victim session to be in a buffered state simultaneously, limiting mass exploitation but not targeted attacks against high-value SAP landscapes. Successful exploitation yields high confidentiality and integrity impact consistent with full session takeover; no public exploit code or active exploitation has been identified at time of analysis.
Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle.
XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote users to read arbitrary files from the server filesystem or conduct server-side request forgery against internal network resources. Affected releases span App Connect Enterprise 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. The CVSS scope-change flag (S:C) reflects that a successful XXE can pivot beyond the integration engine itself into adjacent internal infrastructure. No public exploit has been identified at time of analysis, and IBM has released a patch.
Regular Expression Denial of Service in SAP S/4HANA (Private Cloud) allows unauthenticated remote attackers to exhaust server resources by supplying specially crafted input to a network-accessible endpoint that invokes a vulnerable third-party regex component (CWE-1333). Successful exploitation causes high availability impact with no confidentiality or integrity exposure, making this a targeted disruption risk against a critical ERP platform. No active exploitation has been confirmed - the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch.
SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. No public exploit or active exploitation has been identified at time of analysis, but the CVSS scope change (S:C) signals that successfully decrypted credentials can be used to compromise systems beyond the BI platform itself.
Missing authorization checks in SAP ABAP Developer Tools (the Eclipse-based IDE for ABAP development) allow any low-privileged SAP user to execute unauthorized database operations against SAP NetWeaver AS ABAP backends. The flaw spans a wide range of SAP_BASIS releases (750 through 920) and yields full confidentiality, integrity, and availability compromise of the ABAP application layer - including the ability to read sensitive business data, modify application records, and disrupt legitimate user access. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage elevate real-world risk considerably for enterprises running ADT-connected NetWeaver systems.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible due to a missing authorization check on scheduling-related API endpoints. Any network-reachable attacker without credentials can retrieve, create, modify, or delete scheduling data managed by the application, impacting confidentiality, integrity, and availability at a low severity level each. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions - no authentication, no user interaction, low complexity - lower the barrier to opportunistic abuse significantly.
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend operations to unauthenticated remote attackers via crafted HTTP requests with specific parameter values. Successful exploitation grants read, create, modify, and delete access to application-managed business data, producing a limited but tripartite impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at this time, though the zero-privilege network vector lowers the bar for opportunistic probing.
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outside intended directory boundaries by supplying specially crafted input to affected file path validation functions. Exploitation requires a legitimate user to subsequently interact with the attacker-influenced content and depends on conditions outside the attacker's direct control, as reflected by the AC:H and UI:R CVSS metrics. Successful exploitation achieves a scope change affecting adjacent components with high impact on confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing exist at time of analysis.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Insecure deserialization in the SAP Change and Transport System Attach Tool (ctsattach) lets an authenticated, low-privileged attacker achieve remote code execution by supplying a crafted archive that a victim then processes through the tool's library. Successful exploitation yields high confidentiality and integrity impact - attackers can read sensitive data and take control of the host and its processes - with low availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause and 7.6 CVSS make this a meaningful patch priority for SAP landscapes.
Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed.
Reflected cross-site scripting in SAP NetWeaver Application Server Java (specifically the Configuration Wizard component) lets an unauthenticated attacker embed malicious JavaScript in crafted URLs that executes in a victim's browser when the link is opened. Because the CVSS scope is changed (S:C) and confidentiality impact is high, a successful lure can expose sensitive session information and tamper with non-sensitive data rendered in the client. No public exploit identified at time of analysis, but the 8.2 CVSS and unauthenticated, network-reachable vector make it a meaningful phishing-driven risk for exposed SAP portals.
Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack.
Unauthorized access in SAP Approuter arises because the component fails to validate incoming request headers during the OAuth2 login flow under certain configurations (CWE-601, open redirect). An unauthenticated remote attacker who lures a victim into clicking a crafted link can hijack the authentication flow to gain high-confidentiality and high-integrity access to the application. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, low-complexity nature (CVSS 8.1) makes it a meaningful patch priority for SAP BTP/Cloud Foundry environments.
Request-response desynchronization in SAP Approuter lets an unauthenticated remote attacker send a specially crafted HTTP request that smuggles a second request past the front end, allowing exposure of other users' HTTP responses and denial of service against the application. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) and was reported by SAP; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Signed XML message tampering in SAP NetWeaver Application Server ABAP and ABAP Platform allows authenticated low-privileged attackers to forge identity information by capturing a valid signed message and submitting modified signed XML documents that the verifier accepts. The scope-changing flaw (CVSS 9.9) enables unauthorized access to sensitive user data and disruption of normal operations across trust boundaries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Path traversal in SAP NetWeaver Application Server Java's Web Container allows unauthenticated remote attackers to manipulate file inclusion parameters within crafted HTTP logon requests, leading to inclusion and processing of arbitrary local files. Successful exploitation can expose or modify sensitive data and render portions of the server unavailable, with no public exploit identified at time of analysis but a CVSS of 9.0 reflecting full CIA impact with scope change.
Unauthenticated remote memory corruption in the SAP Kernel of SAP NetWeaver Application Server ABAP and ABAP Platform allows attackers to compromise confidentiality, integrity, and availability by sending crafted RFC requests that trigger logical errors in memory management. The CVSS 9.8 score reflects network-reachable, no-privileges, no-interaction exploitation against a foundational SAP component, though no public exploit identified at time of analysis and exploitation status beyond the vendor disclosure is not confirmed in CISA KEV.
Arbitrary server-side code execution in SAP Commerce Cloud via unauthenticated malicious configuration upload and code injection. Attackers can remotely exploit a misconfigured Spring Security framework to upload crafted configuration files and inject code without authentication, requiring only that a user interact with malicious content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). The vulnerability affects SAP Commerce Cloud Configuration with critical impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, though EPSS data unavailable. Patch details available in SAP Security Note 3733064.
SQL injection in SAP S/4HANA Enterprise Search for ABAP allows authenticated attackers to extract sensitive database information and crash the application via malicious SQL statements injected through improperly validated user input. The scope change (S:C) indicates potential lateral movement beyond the vulnerable component. SAP has released security patches (SAP Note 3724838) for this critical vulnerability with CVSS 9.6. No active exploitation confirmed at time of analysis, though the authentication bypass tag suggests potential credential bypass implications.
OS command injection in SAP Forecasting & Replenishment allows authenticated administrators to execute arbitrary system commands through abuse of a non-remote-enabled function, leading to complete system compromise. The vulnerability enables full read/write access to system data and potential system shutdown, though exploitation is constrained to local attack vectors and requires high-privilege administrative access (CVSS 8.2). No public exploit code or active exploitation confirmed at time of analysis, with vendor patch available via SAP Security Patch Day.
SQL injection in SAP Business Planning and Consolidation (BPC) and SAP Business Warehouse (BW) allows authenticated users to execute arbitrary SQL commands against the database. Affected versions span SAP_BW 750-758, BPC4HANA 300, and HANABPC 810/816. The scope-change vector (S:C) indicates attackers can pivot beyond the vulnerable component to compromise database resources serving multiple SAP applications. Despite critical CVSS 9.9 severity, EPSS exploitation probability remains low (0.05%, 14th percentile) with CISA SSVC indicating no current exploitation and non-automatable attack profile. SAP security note 3719353 provides remediation guidance.
Authenticated remote attackers can overwrite eight-character executable ABAP reports in SAP ERP and SAP S/4HANA systems due to missing authorization checks, enabling denial-of-service conditions when legitimate users execute corrupted reports. This authorization bypass (CWE-862) requires low-privilege authenticated access (CVSS PR:L) and has low attack complexity, combining limited integrity impact with high availability impact (CVSS 7.1). EPSS data not provided; no public exploit identified at time of analysis. Affects SAP ERP and SAP S/4HANA Private Cloud and On-Premise deployments.
SAP NetWeaver Enterprise Portal Administration has an insecure deserialization vulnerability allowing privileged users to execute code through uploaded files.
Authenticated users in SAP Solution Tools Plug-In (ST-PI) can access sensitive information through a function module that lacks proper authorization controls, allowing disclosure of confidential data without requiring additional privileges. The vulnerability affects all users with basic authentication to the affected SAP systems, as the missing checks permit lateral data exposure across the application.
Denial-of-service vulnerability in SAP Advanced Planning And Optimization and Supply Chain Management allows authenticated users to exhaust system resources by repeatedly calling a remote function module with oversized parameters, causing service unavailability. An attacker with standard user credentials and network access can trigger prolonged resource consumption that may render the affected system unresponsive. No patch is currently available.
Sap Basis versions up to 700 is affected by improper verification of cryptographic signature (CVSS 8.8).
Unauthorized Remote Function Call execution in SAP NetWeaver ABAP. Low-privileged users can execute background RFCs without proper authorization checks. CVSS 9.6.
Businessobjects Business Intelligence Platform versions up to 430 is affected by url redirection to untrusted site (open redirect) (CVSS 7.3).
Businessobjects Business Intelligence Platform versions up to 430 is affected by missing authorization (CVSS 7.5).
Unauthorized code execution in SAP CRM and SAP S/4HANA Scripting Editor. Authenticated attacker exploits generic function module call to execute unauthorized ABAP code. CVSS 9.9.
Businessobjects Business Intelligence Platform versions up to 430 contains a security vulnerability (CVSS 7.5).
SAP Fiori App Intercompany Balance Reconciliation fails to enforce proper authorization controls, allowing authenticated users to escalate privileges and access or modify sensitive data they should not have permission to view. An attacker with valid credentials can exploit missing access checks to compromise the confidentiality and integrity of financial reconciliation data. No patch is currently available for this vulnerability.
SAP Application Server for ABAP and NetWeaver RFCSDK contain an OS command injection vulnerability that allows authenticated administrators with adjacent network access to execute arbitrary system commands by uploading malicious content. Successful exploitation results in complete system compromise affecting confidentiality, integrity, and availability. No patch is currently available.
Netweaver Application Server Abap versions up to 700 is affected by missing authorization (CVSS 8.1).
SAP S/4HANA General Ledger (Private Cloud and On-Premise) has SQL injection allowing authenticated users to read, modify, and delete backend database data with scope change (CVSS 9.9). Financial data is directly at risk.
SAP Wily Introscope Enterprise Manager uses a vulnerable third-party component that allows unauthenticated attackers to create malicious JNLP files at public URLs. Victims who click these URLs execute OS commands on their machines. Scope change. Patch available.
SAP S/4HANA (Private Cloud and On-Premise) has the same backdoor vulnerability as CVE-2026-0491 – admin-exploitable ABAP/OS command injection via RFC function module. Patch available.
Hana Database versions up to 2.00 is affected by missing authentication for critical function (CVSS 8.8).
SAP Landscape Transformation has an admin-exploitable backdoor via RFC function module that allows injection of arbitrary ABAP code and OS commands, bypassing authorization checks. Scope change enables full SAP system compromise.
SAP NetWeaver Visual Composer allows privileged users to upload untrusted content that is deserialized on the server, enabling remote code execution. Companion to CVE-2025-31324.
Unauthenticated remote code execution in SAP NetWeaver Visual Composer (Metadata Uploader component) allows attackers to upload arbitrary executable binaries to the host without any authentication, leading to full system compromise. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and Onapsis and multiple outlets report opportunistic attacks against internet-exposed NetWeaver Application Server Java systems. Its 97th-percentile EPSS (32.16%) and 9.8 CVSS underline it as a top-priority, mass-exploitable vulnerability.
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory". Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote unauthenticated code execution in SAP NetWeaver Application Server Java (pre-7.3) through the Invoker Servlet allows attackers to bypass authentication and execute arbitrary code. Confirmed actively exploited (CISA KEV) from 2013 through 2016 in 'Detour' attacks targeting SAP business applications. CVSS 10.0 with EPSS 16.90% (95th percentile) indicates both maximum theoretical severity and sustained real-world exploitation. This remains a critical priority for organizations running legacy SAP NetWeaver Java instances despite the vulnerability's age.
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 77.7%.
Open redirect in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, enabling user-information tracking and page defacement. The vulnerability requires user interaction (UI:R) and results in low confidentiality and integrity impact with no availability impact, yielding a CVSS score of 6.1. No public exploit code has been identified at time of analysis.
Improper authorization checks in SAP S/4HANA's Linear Asset Management RAP business object allow an authenticated, low-privilege user with local/interactive access to modify associated business object data for which they lack authorization, producing a high integrity impact with no confidentiality or availability impact (CVSS 4.7). Exploitation requires high attack complexity and specific runtime or data-association conditions, and no remote or unauthenticated path is described; no public exploit identified at time of analysis. SAP has assigned CWE-862 and published remediation guidance via SAP Security Note 3799621.
Unauthenticated information disclosure in SAP NetWeaver Enterprise Portal allows remote attackers to bypass resource restrictions and retrieve non-critical application information, producing only a low confidentiality impact (CVSS 5.3). The issue is mapped to CWE-552 and tagged as path traversal, so exposed portals may leak reconnaissance-grade data rather than credentials or code execution. No public exploit identified at time of analysis; exposure is reduced when the portal is not internet-facing or is protected by a reverse proxy/WAF that filters traversal patterns.
Reflected cross-site scripting in SAP NetWeaver Enterprise Portal allows unauthenticated remote attackers to inject a malicious script into a URL parameter that is reflected back in the server response, where it executes in the browser of any portal user who opens the crafted link. Exploitation depends on user interaction (CVSS 3.1 base 6.1, MEDIUM, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and can result in theft of session information, manipulation of portal content, or redirection of the victim. No public exploit identified at time of analysis.
Insufficient input validation in SAP UI5 allows an authenticated, low-privileged user to submit crafted content that is later rendered in another user's browser, producing a low-impact client-side injection (CVSS 4.4, Medium) that can affect the confidentiality and integrity of the victim's session but not availability. Exploitation is substantially constrained: the assessed vector (AV:N/AC:H/PR:L/UI:R/S:C) requires a valid low-privilege account, the application to be running in one of the specific non-default configurations where validation is inadequate, and a victim to actively open or render the view containing the attacker-supplied content. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exact vulnerable configuration is addressed in SAP Note 3799054.
Token trust-source confusion in SAP's cloud-security-services-integration-library lets the HybridTokenAuthenticator component accept identity tokens minted by an IAS/XSUAA service binding that was never intended as the application's trust source, resulting in unauthorized access at limited confidentiality and integrity impact (CVSS 3.1 base 4.2, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, no availability impact). Only deployments bound to multiple IAS/XSUAA service instances are exposed: an 'ambient' binding must exist for the flaw to trigger, and remote attackers must already hold a valid token issued by that ambient binding before they can authenticate, so single-binding SAP BTP Cloud Foundry applications are not affected. There is no public exploit identified at time of analysis, and all available signals point to a genuinely low-priority issue rather than an urgent one.
Cross-site scripting in applications based on SAP GUI for HTML on SAP NetWeaver Application Server ABAP lets an authenticated attacker (PR:L) inject malicious content through functionality that does not sufficiently sanitize user-supplied input, with the script executing in a second user's browser once that victim interacts with the poisoned content (UI:R). The flaw is rated CVSS 5.4 (CWE-79), with scope change and low confidentiality/integrity impact and no availability impact; SAP is the reporting vendor and has published Security Note 3671819. There is no public exploit identified at time of analysis and no CISA KEV listing, so this should be treated as a medium-severity, credentialed-to-credentialed escalation path rather than an internet-facing emergency.
Stored cross-site scripting in SAP Manufacturing Integration and Intelligence (MII) lets an authenticated, low-privileged attacker persist malicious content that is later rendered and executed in the browser of an authenticated victim who opens the affected page. Scored CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires a valid low-privileged MII account to plant the payload plus victim navigation to the tainted page, so exploitation is limited to the victim's browser context: session information access, modified page content, and local disruption of the application, not server compromise. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Low-privileged attackers positioned on a network adjacent to an SAP Cloud Connector can extract limited information about internal systems by sending specially crafted requests that slip past a flawed authorization check. Exploitation carries a dual prerequisite - adjacency to the connector (AV:A, so not reachable from the public internet) plus valid low-privilege credentials (PR:L) - and the resulting impact is confined to low confidentiality loss with no effect on integrity or availability, which is why this is assessed as a genuinely low-priority issue despite being a real vulnerability at CVSS 3.5. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV); no EPSS data was supplied with this report.
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input, so an unauthenticated attacker can craft a malicious link that, once clicked by a logged-in user, makes the victim's browser pull attacker-controlled content from an external location and potentially expose data from the active session, producing a high confidentiality impact with no effect on integrity or availability. The issue is network-reachable (AV:N) but requires specific crafting conditions (AC:H) plus victim interaction (UI:R), while the attacker needs no credentials (PR:N); the assessed base score is 5.3 (Medium) on vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. No public exploit code was identified at time of analysis, and the weakness class (CWE-95) points to injection into dynamically evaluated code rather than a default-configuration remote compromise, so the realistic risk is a targeted phishing-style data-theft attempt against authenticated launchpad users with sensitive in-session data.
SAPUI5's frame options allowlist feature insufficiently validates parent frame origins, enabling a framing-based social engineering attack against authenticated SAP users. An unauthenticated attacker can host a malicious page that embeds a SAPUI5 application in an iframe while bypassing the configured origin allowlist, then lure an authenticated victim into interacting with it to trigger unintended in-application actions. Impact is limited to low integrity - no confidentiality or availability consequences - and no public exploit or active exploitation (KEV) has been identified.
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day.
Unauthorized administrative interface access in SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server exposes sensitive system state to authenticated low-privileged users. Exploiting this flaw, an attacker with only a basic SAP account can query administrative endpoints normally restricted to higher-privilege roles, retrieving configuration details, system internals, or operational data that could serve as reconnaissance for follow-on attacks. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low authentication bar (any valid low-privilege account) and direct network accessibility make the exposure surface meaningful in enterprise SAP environments.
Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. Impact is confined to confidentiality at a low level; no public exploit or CISA KEV listing has been identified at time of analysis.
Insufficient authorization enforcement in SAP S/4HANA's Manage Bank Chains application allows an authenticated low-privileged user to delete bank chain records outside their permitted scope. The impact is strictly limited to availability - deletion of specific configuration entries - with no confidentiality or integrity exposure, yielding a CVSS 4.3 moderate rating. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to craft a malicious link or page that, when interacted with by an authenticated victim, triggers unintended server-side actions on their behalf. The impact is limited to low-integrity and low-confidentiality effects with no availability impact, confirmed by SAP as part of Security Patch Day (Note 3371336). No public exploit code or active exploitation has been identified at time of analysis.
Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity.
Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected.
Transient CPU exhaustion in SAP Process Integration's SOAP Adapter allows a privileged authenticated user to craft SOAP requests containing deeply nested XML entity definitions (CWE-776, 'XML Bomb' class), temporarily degrading system responsiveness. The vulnerability scores CVSS 2.2, reflecting that exploitation requires high privileges, high attack complexity, and yields only low availability impact with zero confidentiality or integrity consequences. No public exploit code and no CISA KEV listing have been identified, placing this firmly in the low-priority tier despite network reachability.