What’s Vulnerable › Products

SAP_SE SAP NetWeaver vulnerabilities

105 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your SAP_SE SAP NetWeaver version is affected

Exploited SAP_SE SAP NetWeaver vulnerabilities

• CVE-2025-42999 — SAP NetWeaver Deserialization Vulnerability
• CVE-2025-31324 — SAP NetWeaver Unrestricted File Upload Vulnerability
• CVE-2021-38163 — SAP NetWeaver Unrestricted File Upload Vulnerability

Latest SAP_SE SAP NetWeaver vulnerabilities

• CVE-2026-23685 — Insecure Deserialization vulnerability in SAP NetWeaver (JMS service) (CVSS 4.4)
• CVE-2025-42958 — Missing Authentication check in SAP NetWeaver (CVSS 9.1)
• CVE-2025-42968 — Missing Authorization check in SAP NetWeaver (RFC enabled function module) (CVSS 4.3)
• CVE-2025-42999 — SAP NetWeaver Deserialization Vulnerability (CVSS 9.1) — exploited
• CVE-2025-31324 — SAP NetWeaver Unrestricted File Upload Vulnerability (CVSS 9.8) — exploited
• CVE-2025-31331 — Authorization Bypass vulnerability in SAP NetWeaver (CVSS 4.3)
• CVE-2024-33006 — File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 9.6)
• CVE-2024-27898 — Server-Side Request Forgery in SAP NetWeaver (CVSS 5.3)
• CVE-2024-25644 — Information Disclosure vulnerability in NetWeaver (WSRM) (CVSS 5.3)
• CVE-2024-22124 — Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager (CVSS 7.5)
• CVE-2023-41367 — Missing Authentication check in SAP NetWeaver (Guided Procedures) (CVSS 5.3)
• CVE-2023-36922 — OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL) (CVSS 8.8)
• CVE-2023-33985 — Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (CVSS 6.1)
• CVE-2023-33984 — Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository) (CVSS 5.4)
• CVE-2023-32114 — Denial of Service in SAP NetWeaver (CVSS 2.7)
• CVE-2023-29186 — Directory/Path Traversal vulnerability in SAP NetWeaver. (CVSS 6.5)
• CVE-2023-27499 — Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML (CVSS 6.1)
• CVE-2023-0021 — Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (CVSS 6.1)
• CVE-2022-28217 — (CVSS 6.5)
• CVE-2022-28773 — (CVSS 7.5)
• CVE-2022-28772 — (CVSS 7.5)
• CVE-2022-22534 — (CVSS 6.1)
• CVE-2021-38183 — (CVSS 6.1)
• CVE-2021-38163 — SAP NetWeaver Unrestricted File Upload Vulnerability (CVSS 8.8) — exploited
• CVE-2021-21481 — (CVSS 8.8)