67
CVEs
9
Critical
14
High
0
KEV
1
PoC
19
Unpatched C/H
25.4%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
9
HIGH
14
MEDIUM
35
LOW
8
Monthly CVE Trend
Affected Products (30)
Java
129
3D Visual Enterprise Viewer
128
Netweaver
90
Netweaver Application Server Abap
75
Businessobjects Business Intelligence Platform
71
Netweaver Application Server Java
59
Businessobjects Business Intelligence
45
Hana
38
Open Redirect
36
Solution Manager
32
Adaptive Server Enterprise
30
Business One
30
3D Visual Enterprise Author
27
Internet Graphics Server
23
Netweaver Process Integration
21
Netweaver Enterprise Portal
20
Netweaver Abap
18
Commerce Cloud
18
Hana Extended Application Services
18
Business Objects Business Intelligence Platform
17
Businessobjects
17
Sap Basis
17
Disclosure Management
16
Host Agent
15
Enable Now
14
S 4Hana
13
Customer Relationship Management Webclient Ui
12
Abap Platform
12
S4core
12
Sap Business Ai Platform Approuter
11
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-58231 | Unauthenticated remote code execution in SAP Commerce Cloud's Data Hub Adapter lets attackers abuse a default authentication client to send specially crafted input to functions that lack sufficient validation, yielding arbitrary code execution and a scope change that compromises internal components. This is a maximum-severity CVSS 10.0 flaw (CWE-94 code injection) affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis, but the trivial attack profile (network, low complexity, no authentication, no user interaction) makes it a top-priority patch. | CRITICAL | 10.0 | 0.7% | 71 |
PoC
No patch
|
| CVE-2026-58240 | Component-registration authentication bypass in the SAP NetWeaver Message Server allows an unauthenticated attacker with network access to register a rogue application server component into an SAP system landscape. Because the Message Server does not verify the authenticity of internal application server components during registration (CWE-308), a fraudulent component can be introduced to intercept traffic, manipulate application logic, or disrupt service, yielding full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; the fix is delivered through SAP Security Note 3759472 in the SAP Security Patch Day cycle. | CRITICAL | 9.8 | 0.3% | 54 |
No patch
|
| CVE-2026-76969 | Credential exposure in the @sap/cds-mtxs NPM library - the multitenancy and extensibility (MTXS) component of SAP's Cloud Application Programming Model (CAP) - lets an unauthenticated remote attacker send specially crafted requests to multitenant CAP applications that have extensibility enabled, harvest sensitive tenant credentials, and reuse them to replace or delete tenant data. The flaw is rooted in insufficient authorization/protection checks (CWE-522), yielding high integrity and availability impact with partial confidentiality exposure of business data. Reported and patched by SAP via SAP Note 3798315; no public exploit identified at time of analysis. | CRITICAL | 9.4 | 0.3% | 52 |
No patch
|
| CVE-2026-66768 | Arbitrary command execution in SAP GUI for Java arises because the client does not correctly enforce its trust-level policy for certain functions that a connected backend can invoke. A low-privileged attacker who controls or compromises a backend SAP system can trigger the affected client-side functionality to run commands on the connected user's workstation, with high impact to confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.0 (scope-changed, requiring user interaction), it was reported by SAP with a fix note, and there is no public exploit identified at time of analysis. | CRITICAL | 9.0 | 0.3% | 50 |
No patch
|
| CVE-2026-44747 | Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack. | CRITICAL | 9.9 | 0.4% | 50 |
No patch
|
| CVE-2026-34265 | Memory corruption in SAP NetWeaver Application Server ABAP lets an unauthenticated, remote attacker abuse logical flaws in the proprietary DIAG protocol parser to overwrite out-of-bounds memory, potentially leaking sensitive system data or crashing the ABAP work processes. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and is classified CWE-787 (out-of-bounds write); it was disclosed and patched by SAP via a monthly Security Patch Day note. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-27690 | Request-response desynchronization in SAP Approuter lets an unauthenticated remote attacker send a specially crafted HTTP request that smuggles a second request past the front end, allowing exposure of other users' HTTP responses and denial of service against the application. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) and was reported by SAP; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.5% | 46 |
|
| CVE-2026-44758 | OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-44761 | Authentication bypass via well-known default credentials in SAP Commerce Cloud allows an unauthenticated remote attacker to abuse a pre-provisioned sample OAuth2 client whose client ID and secret are published in SAP Help Portal documentation. If the sample client is left in place, the attacker mints a valid OAuth2 access token and calls certain APIs to read and modify business data (CVSS 9.1, high confidentiality and integrity impact, no availability impact). No public exploit identified at time of analysis, but the credentials are publicly documented, making exploitation trivial wherever the sample configuration was never removed. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|
| CVE-2026-58243 | Missing authorization checks in SAP ABAP Developer Tools (the Eclipse-based IDE for ABAP development) allow any low-privileged SAP user to execute unauthorized database operations against SAP NetWeaver AS ABAP backends. The flaw spans a wide range of SAP_BASIS releases (750 through 920) and yields full confidentiality, integrity, and availability compromise of the ABAP application layer - including the ability to read sensitive business data, modify application records, and disrupt legitimate user access. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version coverage elevate real-world risk considerably for enterprises running ADT-connected NetWeaver systems. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-76958 | XML External Entity (XXE) injection in SAP Integration Suite allows low-privileged remote attackers to read arbitrary server-side files and trigger resource exhaustion via maliciously crafted XML payloads submitted to internal integration components. The vulnerability carries a scope-changed CVSS of 8.5 because the XML parser's external entity resolution crosses trust boundaries, exposing server filesystem contents through monitoring or logging channels. No public exploit code has been identified at time of analysis, but SAP has issued a Security Note (3792978) addressing the flaw. | HIGH | 8.5 | 0.2% | 43 |
No patch
|
| CVE-2026-44752 | Reflected cross-site scripting in SAP NetWeaver Application Server Java (specifically the Configuration Wizard component) lets an unauthenticated attacker embed malicious JavaScript in crafted URLs that executes in a victim's browser when the link is opened. Because the CVSS scope is changed (S:C) and confidentiality impact is high, a successful lure can expose sensitive session information and tamper with non-sensitive data rendered in the client. No public exploit identified at time of analysis, but the 8.2 CVSS and unauthenticated, network-reachable vector make it a meaningful phishing-driven risk for exposed SAP portals. | HIGH | 8.2 | 0.3% | 41 |
No patch
|
| CVE-2026-44745 | Unauthorized access in SAP Approuter arises because the component fails to validate incoming request headers during the OAuth2 login flow under certain configurations (CWE-601, open redirect). An unauthenticated remote attacker who lures a victim into clicking a crafted link can hijack the authentication flow to gain high-confidentiality and high-integrity access to the application. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, low-complexity nature (CVSS 8.1) makes it a meaningful patch priority for SAP BTP/Cloud Foundry environments. | HIGH | 8.1 | 0.3% | 41 |
|
| CVE-2026-66763 | SAP BusinessObjects Business Intelligence Platform (Central Management Server) protects user credential objects with a hard-coded cryptographic key, enabling a high-privileged local attacker to retrieve those objects and decrypt their contents. Affected versions include ENTERPRISE 430, 2025, and 2027 of the CMS component. No public exploit or active exploitation has been identified at time of analysis, but the CVSS scope change (S:C) signals that successfully decrypted credentials can be used to compromise systems beyond the BI platform itself. | HIGH | 7.9 | 0.1% | 40 |
No patch
|
| CVE-2026-76967 | Arbitrary code execution in SAP NetWeaver Business Client (all versions per CPE) is achievable by a low-privileged local attacker who replaces application startup data with maliciously crafted serialized content. When the targeted user next launches the application, the deserialized payload executes in the user's security context, yielding full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 7.8 | 0.2% | 39 |
No patch
|