187
CVEs
23
Critical
29
High
0
KEV
1
PoC
44
Unpatched C/H
11.8%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
23
HIGH
29
MEDIUM
117
LOW
17
Monthly CVE Trend
Affected Products (30)
Java
129
3D Visual Enterprise Viewer
128
Netweaver
90
Netweaver Application Server Abap
75
Businessobjects Business Intelligence Platform
71
Netweaver Application Server Java
59
Businessobjects Business Intelligence
45
Hana
38
Open Redirect
36
Solution Manager
32
Adaptive Server Enterprise
30
Business One
30
3D Visual Enterprise Author
27
Internet Graphics Server
23
Netweaver Process Integration
21
Netweaver Enterprise Portal
20
Netweaver Abap
18
Commerce Cloud
18
Hana Extended Application Services
18
Business Objects Business Intelligence Platform
17
Businessobjects
17
Sap Basis
17
Disclosure Management
16
Host Agent
15
Enable Now
14
S 4Hana
13
Customer Relationship Management Webclient Ui
12
Abap Platform
12
S4core
12
Sap Business Ai Platform Approuter
11
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-58231 | Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch. | CRITICAL | 10.0 | 0.7% | 71 |
PoC
No patch
|
| CVE-2026-58240 | Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle. | CRITICAL | 9.8 | 0.3% | 54 |
No patch
|
| CVE-2026-76969 | Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis. | CRITICAL | 9.4 | 0.3% | 52 |
No patch
|
| CVE-2026-66768 | Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis. | CRITICAL | 9.0 | 0.3% | 50 |
No patch
|
| CVE-2026-44747 | Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack. | CRITICAL | 9.9 | 0.4% | 50 |
No patch
|
| CVE-2026-0501 | SAP S/4HANA General Ledger (Private Cloud and On-Premise) has SQL injection allowing authenticated users to read, modify, and delete backend database data with scope change (CVSS 9.9). Financial data is directly at risk. | CRITICAL | 9.9 | 0.1% | 50 |
No patch
|
| CVE-2026-27681 | SQL injection in SAP Business Planning and Consolidation (BPC) and SAP Business Warehouse (BW) allows authenticated users to execute arbitrary SQL commands against the database. Affected versions span SAP_BW 750-758, BPC4HANA 300, and HANABPC 810/816. The scope-change vector (S:C) indicates attackers can pivot beyond the vulnerable component to compromise database resources serving multiple SAP applications. Despite critical CVSS 9.9 severity, EPSS exploitation probability remains low (0.05%, 14th percentile) with CISA SSVC indicating no current exploitation and non-automatable attack profile. SAP security note 3719353 provides remediation guidance. | CRITICAL | 9.9 | 0.0% | 50 |
No patch
|
| CVE-2026-44748 | Signed XML message tampering in SAP NetWeaver Application Server ABAP and ABAP Platform allows authenticated low-privileged attackers to forge identity information by capturing a valid signed message and submitting modified signed XML documents that the verifier accepts. The scope-changing flaw (CVSS 9.9) enables unauthorized access to sensitive user data and disruption of normal operations across trust boundaries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.9 | 0.0% | 50 |
No patch
|
| CVE-2026-0488 | Unauthorized code execution in SAP CRM and SAP S/4HANA Scripting Editor. Authenticated attacker exploits generic function module call to execute unauthorized ABAP code. CVSS 9.9. | CRITICAL | 9.9 | 0.0% | 50 |
No patch
|
| CVE-2026-34265 | Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-27671 | Unauthenticated remote memory corruption in the SAP Kernel of SAP NetWeaver Application Server ABAP and ABAP Platform allows attackers to compromise confidentiality, integrity, and availability by sending crafted RFC requests that trigger logical errors in memory management. The CVSS 9.8 score reflects network-reachable, no-privileges, no-interaction exploitation against a foundational SAP component, though no public exploit identified at time of analysis and exploitation status beyond the vendor disclosure is not confirmed in CISA KEV. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-0500 | SAP Wily Introscope Enterprise Manager uses a vulnerable third-party component that allows unauthenticated attackers to create malicious JNLP files at public URLs. Victims who click these URLs execute OS commands on their machines. Scope change. Patch available. | CRITICAL | 9.6 | 0.1% | 48 |
|
| CVE-2026-34263 | Arbitrary server-side code execution in SAP Commerce Cloud via unauthenticated malicious configuration upload and code injection. Attackers can remotely exploit a misconfigured Spring Security framework to upload crafted configuration files and inject code without authentication, requiring only that a user interact with malicious content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R). The vulnerability affects SAP Commerce Cloud Configuration with critical impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing identified at time of analysis, though EPSS data unavailable. Patch details available in SAP Security Note 3733064. | CRITICAL | 9.6 | 0.0% | 48 |
No patch
|
| CVE-2026-0509 | Unauthorized Remote Function Call execution in SAP NetWeaver ABAP. Low-privileged users can execute background RFCs without proper authorization checks. CVSS 9.6. | CRITICAL | 9.6 | 0.0% | 48 |
No patch
|
| CVE-2026-34260 | SQL injection in SAP S/4HANA Enterprise Search for ABAP allows authenticated attackers to extract sensitive database information and crash the application via malicious SQL statements injected through improperly validated user input. The scope change (S:C) indicates potential lateral movement beyond the vulnerable component. SAP has released security patches (SAP Note 3724838) for this critical vulnerability with CVSS 9.6. No active exploitation confirmed at time of analysis, though the authentication bypass tag suggests potential credential bypass implications. | CRITICAL | 9.6 | 0.0% | 48 |
No patch
|