SAP SE vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-89120 A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness.High 7.1 · Oct 12, 2026
• CVE-2026-89113 SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query.High 8.8 · Oct 12, 2026
• CVE-2026-89111 The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.Critical 10 · Oct 12, 2026
• CVE-2026-89110 SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality.Critical 9.9 · Oct 12, 2026
• CVE-2026-89108 SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality.Critical 9.1 · Oct 12, 2026
• CVE-2026-89107 SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specifCritical 9.9 · Oct 12, 2026
• CVE-2026-58249 SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component.High 7.5 · Oct 12, 2026
• CVE-2026-76969 @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled.Critical 9.4 · Sep 7, 2026
• CVE-2026-76967 SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup.High 7.8 · Sep 7, 2026
• CVE-2026-76958 SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components.High 8.5 · Sep 7, 2026
• CVE-2026-66768 SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system.Critical 9 · Sep 7, 2026
• CVE-2026-66767 SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a prHigh 7.7 · Sep 7, 2026
• CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration.Critical 9.8 · Sep 7, 2026
• CVE-2026-44756 A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library.Critical 10 · Sep 7, 2026
• CVE-2026-66766 SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability.High 7.5 · Aug 24, 2026
• CVE-2026-58231 SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sCritical 10 · Aug 11, 2026
• CVE-2026-66763 SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key.High 7.9 · Aug 10, 2026
• CVE-2026-58243 SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthHigh 8.8 · Aug 10, 2026
• CVE-2026-58230 SAP Approuter does not sufficiently validate certain token content under specific configurations.High 7 · Aug 10, 2026
• CVE-2026-44765 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access schedulingHigh 7.3 · Aug 10, 2026
• CVE-2026-44764 Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests toHigh 7.3 · Aug 10, 2026
• CVE-2026-44763 SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crHigh 7.6 · Aug 10, 2026
• CVE-2026-44758 SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionalityCritical 9.1 · Aug 10, 2026
• CVE-2026-34265 SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption.Critical 9.8 · Aug 10, 2026
• CVE-2026-58233 SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by theHigh 7.6 · Jul 13, 2026