Known vulnerabilities in SAP NetWeaver AS JAVA

Vendor: SAP
Software: SAP NetWeaver AS JAVA
Software CPE: cpe:2.3:a:sap:netweaver_as_java:*:*:*:*:*:*:*:*
Website: https://www.sap.com/
Total vulnerabilities: 33
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting SAP NetWeaver AS JAVA SAP NetWeaver AS JAVA is affected by 33 known vulnerabilities: 1 critical, 3 high, 16 medium, 13 low Critical High Medium Low

Vulnerabilities (33)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134002 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-44746		 CWE-79 Low
No
No
 - 09.06.2026 SB2026060940
#VU133999 - Missing Authorization
CVE-2026-40128		 CWE-862 Medium
No
No
 - 09.06.2026 SB2026060922
SB2026060942
#VU125962 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-27674		 CWE-79 Low
No
No
 - 14.04.2026 SB2026041493
#VU120231 - Improper Validation of Certificate with Host Mismatch
CVE-2025-68161		 CWE-297 Medium
No
No
 - 22.12.2025 SB2025122245
SB2026012084
SB2026012087
and 101 more
#VU118703 - Exposure of sensitive information to an unauthorized actor
CVE-2025-42919		 CWE-200 Medium
No
No
 - 24.11.2025 SB2025112420
#VU116215 - Out-of-bounds read
CVE-2025-9232		 CWE-125 Medium
No
No
 - 01.10.2025 SB2025100119
SB2025100139
SB2025100153
and 13 more
#VU116213 - Out-of-bounds write
CVE-2025-9230		 CWE-787 Medium
No
No
 - 01.10.2025 SB2025100119
SB2025100132
SB2025100133
and 108 more
#VU113819 - Improper Certificate Validation
CVE-2025-42978		 CWE-295 Low
No
No
 - 12.08.2025 SB2025081228
#VU105496 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-27431		 CWE-79 Low
No
No
 - 11.03.2025 SB2025031120
#VU103909 - Improper Access Control
CVE-2025-24869		 CWE-284 Low
No
No
 - 12.02.2025 SB2025021148
#VU103908 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0054		 CWE-79 Low
Available
No
 - 12.02.2025 SB2025021148
#VU103763 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-22126		 CWE-79 Low
No
No
 - 11.02.2025 SB2025021148
#VU102667 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0057		 CWE-79 Low
No
No
 - 14.01.2025 SB2025011450
#VU102658 - Missing Authorization
CVE-2025-0067		 CWE-862 Medium
No
No
 - 14.01.2025 SB2025011450
#VU101371 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CVE-2024-47582		 CWE-776 Medium
No
No
 - 10.12.2024 SB2024121005
#VU101370 - Server-Side Request Forgery (SSRF)
CVE-2024-47580		 CWE-918 Medium
No
No
 - 10.12.2024 SB2024121005
#VU101369 - Server-Side Request Forgery (SSRF)
CVE-2024-47579		 CWE-918 Medium
No
No
 - 10.12.2024 SB2024121005
#VU101368 - Server-Side Request Forgery (SSRF)
CVE-2024-47578		 CWE-918 Medium
No
No
 - 10.12.2024 SB2024121005
#VU100246 - Unprotected Storage of Credentials
CVE-2024-47588		 CWE-256 Low
No
No
 - 12.11.2024 SB2024111251
#VU100245 - Observable discrepancy
CVE-2024-47592		 CWE-203 Low
No
No
 - 12.11.2024 SB2024111251


Showing elements 1 - 20 out of 33