18
CVEs
3
Critical
5
High
0
KEV
0
PoC
7
Unpatched C/H
5.6%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
5
MEDIUM
7
LOW
3
Monthly CVE Trend
Affected Products (30)
Java
129
3D Visual Enterprise Viewer
128
Netweaver
90
Netweaver Application Server Abap
75
Businessobjects Business Intelligence Platform
71
Netweaver Application Server Java
59
Businessobjects Business Intelligence
45
Hana
38
Open Redirect
36
Solution Manager
32
Adaptive Server Enterprise
30
Business One
30
3D Visual Enterprise Author
27
Internet Graphics Server
23
Netweaver Process Integration
21
Netweaver Enterprise Portal
20
Netweaver Abap
18
Commerce Cloud
18
Hana Extended Application Services
18
Business Objects Business Intelligence Platform
17
Businessobjects
17
Sap Basis
17
Disclosure Management
16
Host Agent
15
Enable Now
14
S 4Hana
13
Customer Relationship Management Webclient Ui
12
Abap Platform
12
S4core
12
Sap Business Ai Platform Approuter
11
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-58240 | Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle. | CRITICAL | 9.8 | 0.3% | 54 |
No patch
|
| CVE-2026-76969 | Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis. | CRITICAL | 9.4 | 0.3% | 52 |
No patch
|
| CVE-2026-66768 | Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis. | CRITICAL | 9.0 | 0.3% | 50 |
No patch
|
| CVE-2026-76958 | XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw. | HIGH | 8.5 | 0.2% | 43 |
No patch
|
| CVE-2026-76967 | Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.8 | 0.2% | 39 |
No patch
|
| CVE-2026-81832 | XML external entity injection in the SAP Adapter component of IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote users to read arbitrary files from the server filesystem or conduct server-side request forgery against internal network resources. Affected releases span App Connect Enterprise 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1, plus Integration Bus for z/OS 10.1.0.0-10.1.0.7. The CVSS scope-change flag (S:C) reflects that a successful XXE can pivot beyond the integration engine itself into adjacent internal infrastructure. No public exploit has been identified at time of analysis, and IBM has released a patch. | HIGH | 7.7 | 0.3% | 39 |
|
| CVE-2026-66767 | Session hijacking in SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated remote attacker to assume another authenticated user's session by exploiting an integer underflow that causes a previously buffered request to be reprocessed in the wrong connection context. The attack is constrained by a narrow race-condition timing window requiring a victim session to be in a buffered state simultaneously, limiting mass exploitation but not targeted attacks against high-value SAP landscapes. Successful exploitation yields high confidentiality and integrity impact consistent with full session takeover; no public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.7 | 0.3% | 39 |
No patch
|
| CVE-2026-66766 | Regular Expression Denial of Service in SAP S/4HANA (Private Cloud) allows unauthenticated remote attackers to exhaust server resources by supplying specially crafted input to a network-accessible endpoint that invokes a vulnerable third-party regex component (CWE-1333). Successful exploitation causes high availability impact with no confidentiality or integrity exposure, making this a targeted disruption risk against a critical ERP platform. No active exploitation has been confirmed - the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-76968 | Unauthorized administrative interface access in SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server exposes sensitive system state to authenticated low-privileged users. Exploiting this flaw, an attacker with only a basic SAP account can query administrative endpoints normally restricted to higher-privilege roles, retrieving configuration details, system internals, or operational data that could serve as reconnaissance for follow-on attacks. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low authentication bar (any valid low-privilege account) and direct network accessibility make the exposure surface meaningful in enterprise SAP environments. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-44766 | SQL injection in SAP S/4HANA's Intercompany Matching and Reconciliation (ICR) module allows a low-privileged authenticated user to exfiltrate sensitive data from the underlying database. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation requiring only a standard SAP user account, with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-76971 | Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed as part of SAP Security Patch Day. | MEDIUM | 6.5 | 0.1% | 33 |
No patch
|
| CVE-2026-76959 | Cross-site request forgery in SAP S/4HANA Finance (Advanced Payment Management) allows a low-privileged attacker to trigger unintended financial actions on the web server on behalf of an authenticated victim. The attacker crafts a malicious link or page; if the authenticated victim interacts with it, their browser submits forged requests that bypass CSRF protection, resulting in low-level confidentiality and integrity impact. No public exploit is identified at time of analysis, and availability is unaffected. | MEDIUM | 4.6 | 0.1% | 23 |
No patch
|
| CVE-2026-76977 | SAPUI5's frame options allowlist feature insufficiently validates parent frame origins, enabling a framing-based social engineering attack against authenticated SAP users. An unauthenticated attacker can host a malicious page that embeds a SAPUI5 application in an iframe while bypassing the configured origin allowlist, then lure an authenticated victim into interacting with it to trigger unintended in-application actions. Impact is limited to low integrity - no confidentiality or availability consequences - and no public exploit or active exploitation (KEV) has been identified. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|
| CVE-2026-76962 | Insufficient authorization enforcement in SAP S/4HANA's Manage Bank Chains application allows an authenticated low-privileged user to delete bank chain records outside their permitted scope. The impact is strictly limited to availability - deletion of specific configuration entries - with no confidentiality or integrity exposure, yielding a CVSS 4.3 moderate rating. No public exploit code or CISA KEV listing has been identified at time of analysis. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|
| CVE-2026-76963 | Unauthorized configuration data disclosure in SAP NetWeaver and ABAP Platform allows authenticated network attackers to read sensitive system configuration and security-relevant settings without holding the required authorization. The flaw stems from a missing authorization check (CWE-862) in the Application Server ABAP component, meaning any low-privileged authenticated user can query configuration details that should be restricted to privileged roles. Impact is confined to confidentiality at a low level; no public exploit or CISA KEV listing has been identified at time of analysis. | MEDIUM | 4.3 | 0.2% | 22 |
No patch
|