17
CVEs
4
Critical
3
High
0
KEV
0
PoC
7
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
3
MEDIUM
7
LOW
3
Monthly CVE Trend
Affected Products (30)
Sap Business Ai Platform Approuter
11
Sap Manufacturing Integration And Intelligence
6
Java
4
Open Redirect
4
Sap Netweaver Application Server Abap
4
Sap S 4Hana Finance For Advanced Payment Management
3
Sap Netweaver And Abap Platform
2
Sap Approuter
2
Sap Netweaver Application Server For Abap And Abap Platform
2
Sap Netweaver Application Server Abap Applications Based On Business Server Pages
2
Sap S 4 Hana Create Single Payment
1
Sap Businessobjects Business Intelligence Platform Admin Tools
1
Business Server Pages Application Taf Applauncher
1
Sap Cloud Application Programming Model Cap
1
Sap Hana Extended Application Services Classic Model User Self Service
1
Sap Commerce Cloud Data Hub Adapter
1
Sap Process Integration Soap Adapter
1
Sap Businessobjects Business Intelligence Platform
1
Sap Web Dispatcher Internet Communication Manager And Sap Content Server
1
Sap Netweaver Application Server Java Configuration Wizard
1
Sap Netweaver Application Server Abap And Abap Platform
1
Sap Integration Suite
1
Sap Netweaver Enterprise Portal
1
Sap Netweaver Business Client
1
Sapui5 Search Ui
1
Sap Businessobjects Business Intelligence Platform Central Management Server
1
Sap S 4Hana Project Management Ppm Pro
1
Sap Human Capital Management For Sap S 4Hana
1
Sap Incentive And Commission Management
1
Saprouter On Microsoft Windows
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-44756 | Remote unauthenticated denial-of-service (and possible memory corruption) in SAP's Extended Passport (EPP) processing library allows an attacker to send a crafted network request with a malformed EPP header, triggering a buffer overflow (CWE-120) that leads to undefined behavior and abnormal program termination. Any SAP application relying on the vulnerable EPP processing component is affected; SAP rates it CVSS 10.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 10.0 | 0.3% | 55 |
No patch
|
| CVE-2026-58240 | Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle. | CRITICAL | 9.8 | 0.3% | 54 |
No patch
|
| CVE-2026-76969 | Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis. | CRITICAL | 9.4 | 0.3% | 52 |
No patch
|
| CVE-2026-66768 | Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis. | CRITICAL | 9.0 | 0.3% | 50 |
No patch
|
| CVE-2026-76958 | XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw. | HIGH | 8.5 | 0.2% | 43 |
No patch
|
| CVE-2026-76967 | Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.8 | 0.2% | 39 |
No patch
|
| CVE-2026-66767 | Session hijacking in SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated remote attacker to assume another authenticated user's session by exploiting an integer underflow that causes a previously buffered request to be reprocessed in the wrong connection context. The attack is constrained by a narrow race-condition timing window requiring a victim session to be in a buffered state simultaneously, limiting mass exploitation but not targeted attacks against high-value SAP landscapes. Successful exploitation yields high confidentiality and integrity impact consistent with full session takeover; no public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.7 | 0.3% | 39 |
No patch
|
| CVE-2026-76968 | Unauthorized administrative interface access in SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server exposes sensitive system state to authenticated low-privileged users. Exploiting this flaw, an attacker with only a basic SAP account can query administrative endpoints normally restricted to higher-privilege roles, retrieving configuration details, system internals, or operational data that could serve as reconnaissance for follow-on attacks. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low authentication bar (any valid low-privilege account) and direct network accessibility make the exposure surface meaningful in enterprise SAP environments. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-44766 | SQL injection in SAP S/4HANA's Intercompany Matching and Reconciliation (ICR) module allows a low-privileged authenticated user to exfiltrate sensitive data from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard SAP user account, with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-76971 | Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day. | MEDIUM | 6.5 | 0.1% | 33 |
No patch
|
| CVE-2026-76959 | Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected. | MEDIUM | 4.6 | 0.1% | 23 |
No patch
|
| CVE-2026-76977 | SAPUI5's frame options allowlist feature insufficiently validates parent frame origins, enabling a framing-based social engineering attack against authenticated SAP users. An unauthenticated attacker can host a malicious page that embeds a SAPUI5 application in an iframe while bypassing the configured origin allowlist, then lure an authenticated victim into interacting with it to trigger unintended in-application actions. Impact is limited to low integrity - no confidentiality or availability consequences - and no public exploit or active exploitation (KEV) has been identified. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|
| CVE-2026-76962 | Insufficient authorization enforcement in SAP S/4HANA's Manage Bank Chains application allows an authenticated low-privileged user to delete bank chain records outside their permitted scope. The impact is strictly limited to availability - deletion of specific configuration entries - with no confidentiality or integrity exposure, yielding a CVSS 4.3 moderate rating. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|
| CVE-2026-76963 | Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. Impact is confined to confidentiality at a low level; no public exploit or CISA KEV listing has been identified at time of analysis. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|
| CVE-2026-76960 | Cross-Site Request Forgery in SAP S/4HANA Finance (Advanced Payment Management) enables a low-privileged attacker to craft a malicious link or web page that, when visited by an authenticated user, submits unauthorized requests to the SAP web server on that user's behalf. The impact is bounded by the description to low integrity and low confidentiality effects, with no availability impact. No public exploit or KEV listing exists at time of analysis, and CVSS 3.5 correctly reflects the low overall severity. | LOW | 3.5 | 0.1% | 18 |
No patch
|