CVEs published by SAP SE

CVEs published by SAP SE (CVE Numbering Authority). 34 tracked.

• CVE-2026-58231 CRITICAL 10.0 SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit spec
• CVE-2026-34265 CRITICAL 9.8 SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG pro
• CVE-2026-44758 CRITICAL 9.1 SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit special
• CVE-2026-58243 HIGH 8.8 SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing
• CVE-2026-44765 HIGH 7.3 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unaut
• CVE-2026-44764 HIGH 7.3 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unaut
• CVE-2026-44763 HIGH 7.6 SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path
• CVE-2026-58230 HIGH 7.0 UPGRADE SAP Approuter does not sufficiently validate certain token content under specific configurations
• CVE-2026-58238 MEDIUM 5.9 UPGRADE SAP Approuter does not sufficiently handle certain requests under specific conditions
• CVE-2026-40130 MEDIUM 5.3 SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands
• CVE-2026-58236 MEDIUM 5.5 SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missi
• CVE-2026-58248 MEDIUM 6.5 SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to uplo
• CVE-2026-58247 MEDIUM 5.3 SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component
• CVE-2026-66778 MEDIUM 5.3 UPGRADE SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal com
• CVE-2026-66763 HIGH 7.9 SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user o
• CVE-2026-66777 MEDIUM 5.9 UPGRADE SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend desti
• CVE-2026-66771 MEDIUM 6.1 SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted
• CVE-2026-66779 MEDIUM 6.3 Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated a
• CVE-2026-58235 MEDIUM 6.3 SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and dat
• CVE-2026-66770 MEDIUM 6.3 Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inj
• CVE-2026-66773 MEDIUM 5.9 A malicious or compromised OData service could disclose sensitive authentication information and inject untrus
• CVE-2026-58237 MEDIUM 5.9 UPGRADE WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality
• CVE-2026-58239 LOW 3.7 UPGRADE SAP Approuter does not sufficiently validate tenant context in inbound requests
• CVE-2026-66774 LOW 3.7 UPGRADE SAP Approuter does not consistently handle certain error conditions
• CVE-2026-66760 MEDIUM 6.4 UPGRADE SAP Approuter does not correctly validate client certificates in certain callback flows
• CVE-2026-66761 MEDIUM 4.3 UPGRADE SAP Approuter does not enforce sufficient flow control in certain functionality
• CVE-2026-66776 MEDIUM 5.9 UPGRADE SAP Approuter does not consistently enforce integrity verification on certain session-related request headers
• CVE-2026-66772 MEDIUM 4.3 SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization ch
• CVE-2026-58244 MEDIUM 4.3 SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain
• CVE-2026-66764 MEDIUM 4.3 Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenti
• CVE-2026-58241 MEDIUM 4.2 SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a
• CVE-2026-58245 LOW 3.8 SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source
• CVE-2026-66775 MEDIUM 4.3 UPGRADE SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default
• CVE-2026-44762 LOW 3.7 SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration a

← Back to latest CVEs