SAP
14 SAP flaws are on CISA's list of vulnerabilities attackers have used, 0 of them added in 2026. CISA says 3 are known to be used by ransomware. The latest was added May 15, 2025.
14on CISA's list, all time
0added in 2026
0in the last 90 days
3used by ransomware
2zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| NetWeaver | 10 | May 15, 2025 |
| Commerce Cloud | 1 | Sep 30, 2024 |
| Multiple Products | 1 | Aug 18, 2022 |
| Customer Relationship Management (CRM) | 1 | Nov 3, 2021 |
| Solution Manager | 1 | Nov 3, 2021 |
Latest SAP flaws
- NetWeaverSAP NetWeaver Deserialization Vulnerability
- NetWeaverSAP NetWeaver Unrestricted File Upload Vulnerability
- NetWeaverSAP NetWeaver Directory Traversal Vulnerability
- Commerce CloudSAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
- Multiple ProductsSAP Multiple Products HTTP Request Smuggling Vulnerability
- NetWeaverSAP NetWeaver SQL Injection Vulnerability
- NetWeaverSAP NetWeaver Information Disclosure Vulnerability
- NetWeaverSAP NetWeaver Unrestricted File Upload Vulnerability
- NetWeaverSAP NetWeaver Remote Code Execution Vulnerability
- NetWeaverSAP NetWeaver Directory Traversal Vulnerability
- NetWeaverSAP NetWeaver XML External Entity (XXE) Vulnerability
- Customer Relationship Management (CRM)SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
- Solution ManagerSAP Solution Manager Missing Authentication for Critical Function Vulnerability
- NetWeaverSAP NetWeaver Missing Authentication for Critical Function Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.