SAP vulnerabilities14 known to be exploited.
SAP has 1,531 published vulnerabilities across 443 products in our catalogue. 14 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is 3d Visual Enterprise Viewer, with 131. If you run SAP software, patch the exploited flaws first.
The most recent SAP flaw added to the known-exploited list is CVE-2025-42999, on 15 May 2025. We keep watching the known-exploited list.
Which SAP products have the most vulnerabilities?
3d Visual Enterprise Viewer leads with 131 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which SAP vulnerabilities are being exploited?
14 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.1SAP NetWeaver Deserialization Vulnerability
SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by...
- 10.0SAP NetWeaver Unrestricted File Upload Vulnerability
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
- 7.5SAP NetWeaver Directory Traversal Vulnerability
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a ..
- 9.8SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.
- 10.0SAP Multiple Products HTTP Request Smuggling Vulnerability
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling.
- 9.9SAP NetWeaver Unrestricted File Upload Vulnerability
SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
- 9.8SAP NetWeaver SQL Injection Vulnerability
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- 5.3SAP NetWeaver Information Disclosure Vulnerability
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
Which SAP flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 98%
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to...
- 95%
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a ..
- 95%
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to...
- 80%CVE-2008-0244Critical
SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB...
- 73%CVE-2008-0621High
Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the (1) 0x01, (2) 0x02, (3) 0x03, (4) 0x04, and...
- 72%
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
- 70%CVE-2007-3614High
Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute arbitrary code via (1) a certain cookie value; (2) a certain...
- 70%CVE-2007-3605High
Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP SAP GUI allows remote attackers to execute arbitrary code via a long argument to the...
- 66%CVE-2009-4988Critical
Stack-based buffer overflow in NT_Naming_Service.exe in SAP Business One 2005 A 6.80.123 and 6.80.320 allows remote attackers to execute arbitrary code via a long GIOP request to TCP port 30000.
All SAP products we track.
375 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- 3d Visual Enterprise Viewer3d_visual_enterprise_viewer131 vulnerabilities1 version
- Netweavernetweaver103 vulnerabilities77 versions
- Netweaver Application Server Abapnetweaver_application_server_abap76 vulnerabilities139 versions
- Businessobjects Business Intelligence Platformbusinessobjects_business_intelligence_platform69 vulnerabilities18 versions
- Netweaver Application Server Javanetweaver_application_server_java67 vulnerabilities45 versions
- Businessobjects Business Intelligencebusinessobjects_business_intelligence45 vulnerabilities11 versions
- Hanahana38 vulnerabilities8 versions
- Solution Managersolution_manager33 vulnerabilities12 versions
- Business Onebusiness_one30 vulnerabilities9 versions
- Internet Graphics Serverinternet_graphics_server28 vulnerabilities14 versions
- 3d Visual Enterprise Author3d_visual_enterprise_author27 vulnerabilities2 versions
- Businessobjectsbusinessobjects23 vulnerabilities10 versions
- Netweaver Abapnetweaver_abap21 vulnerabilities73 versions
- Netweaver Process Integrationnetweaver_process_integration21 vulnerabilities14 versions
- Netweaver Enterprise Portalnetweaver_enterprise_portal20 vulnerabilities9 versions
- Business Objects Business Intelligence Platformbusiness_objects_business_intelligence_platform18 vulnerabilities8 versions
- Hana Extended Application Serviceshana_extended_application_services18 vulnerabilities2 versions
- S/4hanas\/4hana17 vulnerabilities24 versions
- Commerce Cloudcommerce_cloud16 vulnerabilities17 versions
- Disclosure Managementdisclosure_management16 vulnerabilities2 versions
- Host Agenthost_agent15 vulnerabilities3 versions
- Sap Basissap_basis15 vulnerabilities21 versions
- Adaptive Server Enterpriseadaptive_server_enterprise14 vulnerabilities12 versions
- Enable Nowenable_now14 vulnerabilities7 versions
This directory lists the 375 SAP products with at least one tracked version, of 443 in our catalogue.
Running SAP? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.
- Matched to
- Netweaver on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 1,531 published vulnerabilities across 443 products and 3,887 versions from SAP. The most recent SAP flaw added to the known-exploited list is CVE-2025-42999, on 15 May 2025.
14 SAP vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2025-42999, CVE-2025-31324 and CVE-2017-12637. The full list is on this page.
3d Visual Enterprise Viewer, with 131 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the SAP products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.