109
CVEs
15
Critical
16
High
0
KEV
1
PoC
27
Unpatched C/H
15.6%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
15
HIGH
16
MEDIUM
65
LOW
12
Monthly CVE Trend
Affected Products (30)
Java
129
3D Visual Enterprise Viewer
128
Netweaver
90
Netweaver Application Server Abap
75
Businessobjects Business Intelligence Platform
71
Netweaver Application Server Java
59
Businessobjects Business Intelligence
45
Hana
38
Open Redirect
36
Solution Manager
32
Adaptive Server Enterprise
30
Business One
30
3D Visual Enterprise Author
27
Internet Graphics Server
23
Netweaver Process Integration
21
Netweaver Enterprise Portal
20
Netweaver Abap
18
Commerce Cloud
18
Hana Extended Application Services
18
Business Objects Business Intelligence Platform
17
Businessobjects
17
Sap Basis
17
Disclosure Management
16
Host Agent
15
Enable Now
14
S 4Hana
13
Customer Relationship Management Webclient Ui
12
Abap Platform
12
S4core
12
Sap Business Ai Platform Approuter
11
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-58231 | Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch. | CRITICAL | 10.0 | 0.7% | 71 |
PoC
No patch
|
| CVE-2026-58240 | Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle. | CRITICAL | 9.8 | 0.3% | 54 |
No patch
|
| CVE-2026-76969 | Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis. | CRITICAL | 9.4 | 0.3% | 52 |
No patch
|
| CVE-2026-66768 | Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis. | CRITICAL | 9.0 | 0.3% | 50 |
No patch
|
| CVE-2026-44747 | Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack. | CRITICAL | 9.9 | 0.4% | 50 |
No patch
|
| CVE-2026-27681 | SQL injection in SAP Business Planning and Consolidation (BPC) and SAP Business Warehouse (BW) allows authenticated users to execute arbitrary SQL commands against the database. Affected versions span SAP_BW 750-758, BPC4HANA 300, and HANABPC 810/816. The scope-change vector (S:C) indicates attackers can pivot beyond the vulnerable component to compromise database resources serving multiple SAP applications. Despite critical CVSS 9.9 severity, EPSS exploitation probability remains low (0.05%, 14th percentile) with CISA SSVC indicating no current exploitation and non-automatable attack profile. SAP security note 3719353 provides remediation guidance. | CRITICAL | 9.9 | 0.0% | 50 |
No patch
|
| CVE-2026-44748 | Signed XML message tampering in SAP NetWeaver Application Server ABAP and ABAP Platform allows authenticated low-privileged attackers to forge identity information by capturing a valid signed message and submitting modified signed XML documents that the verifier accepts. The scope-changing flaw (CVSS 9.9) enables unauthorized access to sensitive user data and disruption of normal operations across trust boundaries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.9 | 0.0% | 50 |
No patch
|
| CVE-2026-34265 | Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-27671 | Unauthenticated remote memory corruption in the SAP Kernel of SAP NetWeaver Application Server ABAP and ABAP Platform allows attackers to compromise confidentiality, integrity, and availability by sending crafted RFC requests that trigger logical errors in memory management. The CVSS 9.8 score reflects network-reachable, no-privileges, no-interaction exploitation against a foundational SAP component, though no public exploit identified at time of analysis and exploitation status beyond the vendor disclosure is not confirmed in CISA KEV. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-34263 | Arbitrary server-side code execution in SAP Commerce Cloud via unauthenticated malicious configuration upload and code injection. Attackers can remotely exploit a misconfigured Spring Security framework to upload crafted configuration files and inject code without authentication, requiring only that a user interact with malicious content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). The vulnerability affects SAP Commerce Cloud Configuration with critical impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, though EPSS data unavailable. Patch details available in SAP Security Note 3733064. | CRITICAL | 9.6 | 0.0% | 48 |
No patch
|
| CVE-2026-34260 | SQL injection in SAP S/4HANA Enterprise Search for ABAP allows authenticated attackers to extract sensitive database information and crash the application via malicious SQL statements injected through improperly validated user input. The scope change (S:C) indicates potential lateral movement beyond the vulnerable component. SAP has released security patches (SAP Note 3724838) for this critical vulnerability with CVSS 9.6. No active exploitation confirmed at time of analysis, though the authentication bypass tag suggests potential credential bypass implications. | CRITICAL | 9.6 | 0.0% | 48 |
No patch
|
| CVE-2026-27690 | Request-response desynchronization in SAP Approuter lets an unauthenticated remote attacker send a specially crafted HTTP request that smuggles a second request past the front end, allowing exposure of other users' HTTP responses and denial of service against the application. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) and was reported by SAP; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.5% | 46 |
|
| CVE-2026-44758 | OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-44761 | Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|
| CVE-2026-40128 | Path traversal in SAP NetWeaver Application Server Java's Web Container allows unauthenticated remote attackers to manipulate file inclusion parameters within crafted HTTP logon requests, leading to inclusion and processing of arbitrary local files. Successful exploitation can expose or modify sensitive data and render portions of the server unavailable, with no public exploit identified at time of analysis but a CVSS of 9.0 reflecting full CIA impact with scope change. | CRITICAL | 9.0 | 0.1% | 45 |
No patch
|