Known vulnerabilities in SAP NetWeaver

Vendor: SAP
Software: SAP NetWeaver
Software CPE: cpe:2.3:a:sap:sap_netweaver:*:*:*:*:*:*:*:*
Website: https://www.sap.com/
Total vulnerabilities: 36
Public exploits: 4
Known exploited (KEV): 5
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting SAP NetWeaver SAP NetWeaver is affected by 36 known vulnerabilities: 3 critical, 5 high, 13 medium, 15 low Critical High Medium Low

Vulnerabilities (36)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU123668 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-27684		 CWE-89 Medium
No
No
 - 10.03.2026 SB2026031023
#VU119390 - Improper input validation
CVE-2025-42874		 CWE-20 Low
No
No
 - 09.12.2025 SB2025120912
#VU117346 - Improper Authorization
CVE-2025-31331		 CWE-285 Medium
No
No
 - 17.10.2025 SB2025101737
#VU114996 - Deserialization of Untrusted Data
CVE-2025-42944		 CWE-502 Critical
No
No
 - 09.09.2025 SB2025090911
#VU112452 - Deserialization of Untrusted Data
CVE-2025-42963		 CWE-502 Medium
No
No
 - 08.07.2025 SB2025070811
#VU112451 - Deserialization of Untrusted Data
CVE-2025-42966		 CWE-502 Medium
No
No
 - 08.07.2025 SB2025070811
#VU112450 - Deserialization of Untrusted Data
CVE-2025-42964		 CWE-502 Medium
No
No
 - 08.07.2025 SB2025070811
#VU112449 - Deserialization of Untrusted Data
CVE-2025-42980		 CWE-502 Medium
No
No
 - 08.07.2025 SB2025070811
#VU110688 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-31325		 CWE-79 Low
No
No
 - 10.06.2025 SB2025061013
#VU110687 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-42977		 CWE-22 Low
No
No
 - 10.06.2025 SB2025061013
#VU109012 - Deserialization of Untrusted Data
CVE-2025-42999		 CWE-502 Medium
No
Exploited
 - 13.05.2025 SB2025051317
#VU107961 - Unrestricted Upload of File with Dangerous Type
CVE-2025-31324		 CWE-434 Critical
Available
Exploited
 - 25.04.2025 SB2025042521
#VU80718 - Improper Access Control
CVE-2023-41367		 CWE-284 Low
No
No
 - 13.09.2023 SB2023091313
#VU78723 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-33989		 CWE-22 Low
No
No
 - 27.07.2023 SB2023072753
#VU78644 - Resource exhaustion
CVE-2023-32114		 CWE-400 Low
No
No
 - 25.07.2023 SB2023072749
#VU78642 - Unrestricted Upload of File with Dangerous Type
CVE-2023-33984		 CWE-434 Low
No
No
 - 25.07.2023 SB2023072749
#VU75126 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-29186		 CWE-22 Low
No
No
 - 14.04.2023 SB2023041430
#VU56491 - Unrestricted Upload of File with Dangerous Type
CVE-2021-38163		 CWE-434 Medium
Available
Exploited
 - 14.09.2021 SB2021091412
#VU55841 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2021-33707		 CWE-601 Low
No
No
 - 13.08.2021 SB2021081310
#VU48827 - Cleartext Storage of Sensitive Information
CVE-2020-26816		 CWE-312 Low
No
No
 - 08.12.2020 SB2020120814


Showing elements 1 - 20 out of 36