Is SAP safe right now?
Nothing new in 90 days
No SAP flaws have been added to CISA's exploited list in the last 90 days (the most recent was May 15, 2025). Keep automatic updates on: that can change any day.
0exploited in the last 30 days
0in the last 90 days
0zero-days in 2026
14on CISA's list, all time
Earlier exploited flaws
- SAP NetWeaver Deserialization Vulnerability Zero-day
- SAP NetWeaver Unrestricted File Upload Vulnerability Zero-day
- SAP NetWeaver Directory Traversal Vulnerability
- SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
- SAP Multiple Products HTTP Request Smuggling Vulnerability
- SAP NetWeaver Unrestricted File Upload Vulnerability
- SAP NetWeaver Information Disclosure Vulnerability
- SAP NetWeaver SQL Injection Vulnerability
- SAP NetWeaver Missing Authentication for Critical Function Vulnerability
- SAP Solution Manager Missing Authentication for Critical Function Vulnerability
- SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
- SAP NetWeaver XML External Entity (XXE) Vulnerability
- SAP NetWeaver Directory Traversal Vulnerability
- SAP NetWeaver Remote Code Execution Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 0 | 0 |
| 2025 | 3 | 2 |
| 2024 | 1 | 0 |
| 2023 | 0 | 0 |
| 2022 | 4 | 0 |
Questions
Is SAP safe right now?
No SAP flaws have been added to CISA's exploited list in the last 90 days (the most recent was May 15, 2025). Keep automatic updates on: that can change any day. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many SAP vulnerabilities have been exploited?
14 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 3 of them used by ransomware.
Covers products matching sap netweaver, sap . Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.