SAP vulnerabilities and fixes

CVEs that mention SAP, ranked by priority. 35 tracked.

SAP has 35 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 24. Most recent: 2026-10-20. Highest priority: CVE-2026-58231 (score 58/100).

• CVE-2026-58231 CRITICAL 10.0 SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit spec
• CVE-2026-34265 CRITICAL 9.8 SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG pro
• CVE-2026-44758 CRITICAL 9.1 SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit special
• CVE-2026-58243 HIGH 8.8 SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing
• CVE-2026-91492 HIGH 8.7 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP
• CVE-2026-44765 HIGH 7.3 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unaut
• CVE-2026-44764 HIGH 7.3 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unaut
• CVE-2026-44763 HIGH 7.6 SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path
• CVE-2026-58230 HIGH 7.0 UPGRADE SAP Approuter does not sufficiently validate certain token content under specific configurations
• CVE-2026-58238 MEDIUM 5.9 UPGRADE SAP Approuter does not sufficiently handle certain requests under specific conditions
• CVE-2026-40130 MEDIUM 5.3 SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands
• CVE-2026-98555 HIGH 7.5 In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llc_mac_hdr
• CVE-2026-58236 MEDIUM 5.5 SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missi
• CVE-2026-58248 MEDIUM 6.5 SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to uplo
• CVE-2026-58247 MEDIUM 5.3 SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component
• CVE-2026-66778 MEDIUM 5.3 UPGRADE SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal com
• CVE-2026-66763 HIGH 7.9 SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user o
• CVE-2026-66777 MEDIUM 5.9 UPGRADE SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend desti
• CVE-2026-66779 MEDIUM 6.3 Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated a
• CVE-2026-58235 MEDIUM 6.3 SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and dat
• CVE-2026-66770 MEDIUM 6.3 Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inj
• CVE-2026-58237 MEDIUM 5.9 UPGRADE WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality
• CVE-2026-58239 LOW 3.7 UPGRADE SAP Approuter does not sufficiently validate tenant context in inbound requests
• CVE-2026-66774 LOW 3.7 UPGRADE SAP Approuter does not consistently handle certain error conditions
• CVE-2026-66760 MEDIUM 6.4 UPGRADE SAP Approuter does not correctly validate client certificates in certain callback flows
• CVE-2026-66761 MEDIUM 4.3 UPGRADE SAP Approuter does not enforce sufficient flow control in certain functionality
• CVE-2026-66776 MEDIUM 5.9 UPGRADE SAP Approuter does not consistently enforce integrity verification on certain session-related request headers
• CVE-2026-66772 MEDIUM 4.3 SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization ch
• CVE-2026-58244 MEDIUM 4.3 SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain
• CVE-2026-66764 MEDIUM 4.3 Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenti
• CVE-2026-58241 MEDIUM 4.2 SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a
• CVE-2026-58246 MEDIUM 4.3 SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information in
• CVE-2026-58245 LOW 3.8 SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source
• CVE-2026-66775 MEDIUM 4.3 UPGRADE SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default
• CVE-2026-44762 LOW 3.7 SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration a

FAQ

How do I fix SAP vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is SAP being exploited right now?

None of the tracked SAP CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which SAP CVE should I patch first?

CVE-2026-58231 currently ranks highest (58/100): SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit spec.

← Back to latest CVEs