What’s Vulnerable › Products

SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform vulnerabilities

124 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 23 published in the last 12 months.

Check whether your SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform version is affected

Exploited SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform vulnerabilities

• CVE-2022-22536 — SAP Multiple Products HTTP Request Smuggling Vulnerability

Latest SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform vulnerabilities

• CVE-2026-76976 — Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) (CVSS 5.4)
• CVE-2026-66767 — Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 7.7)
• CVE-2026-66779 — Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (CVSS 6.3)
• CVE-2026-58236 — OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 5.5)
• CVE-2026-58246 — Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.3)
• CVE-2026-44760 — Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) (CVSS 4.7)
• CVE-2026-44747 — Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP (CVSS 9.9)
• CVE-2026-44751 — Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 7.1)
• CVE-2026-44748 — XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform (CVSS 9.9)
• CVE-2026-27671 — Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (CVSS 9.8)
• CVE-2026-27680 — CSS Injection vulnerability in SAP NetWeaver Application Server ABAP (CVSS 4.3)
• CVE-2026-40135 — OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 6.5)
• CVE-2026-27682 — Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) (CVSS 6.1)
• CVE-2026-34257 — Open Redirect vulnerability in SAP NetWeaver Application Server ABAP (CVSS 6.1)
• CVE-2026-27688 — Missing Authorization check in SAP NetWeaver Application Server for ABAP (CVSS 5.0)
• CVE-2026-24316 — Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP (CVSS 6.4)
• CVE-2026-24310 — Missing Authorization check in SAP NetWeaver Application Server for ABAP (CVSS 4.3)
• CVE-2026-24309 — Missing Authorization check in SAP NetWeaver Application Server for ABAP (CVSS 6.4)
• CVE-2026-0488 — Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor) (CVSS 9.9)
• CVE-2026-0506 — Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 8.1)
• CVE-2025-42882 — Missing Authorization check in SAP NetWeaver Application Server for ABAP (CVSS 4.3)
• CVE-2025-42908 — Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP (CVSS 5.4)
• CVE-2025-42902 — Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform (CVSS 5.3)
• CVE-2025-42945 — HTML Injection vulnerability in SAP NetWeaver Application Server ABAP (CVSS 6.1)
• CVE-2025-42942 — Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP (CVSS 6.1)