Netweaver Application Server Abap (Sap) - vulnerabilities (CVEs)

86 CVEs, 0 in the last 30 days, 174 known versions, newest CVE from 2026-05-14. Vendor: Sap.

CVEs of Netweaver Application Server Abap

• CVE-2026-27680 - CVSS 4.3 (medium), 2026-05-14: Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets…
• CVE-2026-40135 - CVSS 6.5 (medium), 2026-05-12: An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with…
• CVE-2026-27682 - CVSS 6.1 (medium), 2026-05-12: Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an…
• CVE-2026-34257 - CVSS 6.1 (medium), 2026-04-14: Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a…
• CVE-2026-27688 - CVSS 5 (medium), 2026-03-10: Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer…
• CVE-2026-24316 - CVSS 6.4 (medium), 2026-03-10: SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external…
• CVE-2026-24310 - CVSS 4.3 (medium), 2026-03-10: Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and…
• CVE-2026-24309 - CVSS 6.4 (medium), 2026-03-10: Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to…
• CVE-2026-0488 - CVSS 9.9 (critical), 2026-02-10: An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized…
• CVE-2026-0506 - CVSS 8.1 (high), 2026-01-13: Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to…
• CVE-2024-41728 - CVSS 2.7 (low), 2024-09-10: Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects…
• CVE-2024-44114 - CVSS 2.7 (low), 2024-09-10: SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This…
• CVE-2024-41734 - CVSS 4.3 (medium), 2024-08-13: Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction,…
• CVE-2024-41732 - CVSS 5.4 (medium), 2024-08-13: SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web…
• CVE-2024-33001 - CVSS 6.5 (medium), 2024-06-11: SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of…
• CVE-2024-24740 - CVSS 5.3 (medium), 2024-02-13: SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53,…
• CVE-2024-21738 - CVSS 5.4 (medium), 2024-01-09: SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS)…
• CVE-2023-49581 - CVSS 9.4 (critical), 2023-12-12: SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In…
• CVE-2023-41366 - CVSS 5.3 (medium), 2023-11-14: Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL…
• CVE-2023-40624 - CVSS 5.5 (medium), 2023-09-12: SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702,…
• CVE-2023-40309 - CVSS 9.8 (critical), 2023-09-12: SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user,…
• CVE-2023-40308 - CVSS 7.5 (high), 2023-09-12: SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library…
• CVE-2023-37492 - CVSS 6.5 (medium), 2023-08-08: SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750,…
• CVE-2023-35874 - CVSS 7.4 (high), 2023-07-11: SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL…
• CVE-2023-28763 - CVSS 6.5 (medium), 2023-04-11: SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a…
• CVE-2023-27499 - CVSS 6.1 (medium), 2023-04-11: SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently…
• CVE-2023-27501 - CVSS 9.6 (critical), 2023-03-14: SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit…
• CVE-2023-27500 - CVSS 9.6 (critical), 2023-03-14: An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no…
• CVE-2023-27270 - CVSS 6.5 (medium), 2023-03-14: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple…
• CVE-2023-27269 - CVSS 9.6 (critical), 2023-03-14: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an…
• CVE-2023-26459 - CVSS 7.4 (high), 2023-03-14: Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791,…
• CVE-2023-25618 - CVSS 6.5 (medium), 2023-03-14: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple…
• CVE-2023-25614 - CVSS 6.1 (medium), 2023-02-14: SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unauthenticated…
• CVE-2023-23860 - CVSS 6.1 (medium), 2023-02-14: SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a…
• CVE-2023-23859 - CVSS 6.1 (medium), 2023-02-14: SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a…
• CVE-2023-24522 - CVSS 6.1 (medium), 2023-02-14: Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to…
• CVE-2023-23854 - CVSS 5.4 (medium), 2023-02-14: SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks…
• CVE-2023-23853 - CVSS 6.1 (medium), 2023-02-14: An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756,…
• CVE-2023-23858 - CVSS 6.1 (medium), 2023-02-14: Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an…
• CVE-2023-0014 - CVSS 9.8 (critical), 2023-01-10: SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22,…
• CVE-2023-0013 - CVSS 6.1 (medium), 2023-01-10: The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP…
• CVE-2022-41215 - CVSS 4.7 (medium), 2022-11-08: SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This…
• CVE-2022-41214 - CVSS 8.7 (high), 2022-11-08: Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote…
• CVE-2022-41212 - CVSS 4.9 (medium), 2022-11-08: Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote…
• CVE-2022-39799 - CVSS 6.1 (medium), 2022-09-13: An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site…
• CVE-2022-35294 - CVSS 5.4 (medium), 2022-09-13: An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and…
• CVE-2022-29610 - CVSS 5.4 (medium), 2022-05-11: SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored…
• CVE-2022-29611 - CVSS 8.8 (high), 2022-05-11: SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation…
• CVE-2022-26102 - CVSS 5.4 (medium), 2022-03-10: Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access…
• CVE-2022-22536 - CVSS 10 (critical), 2022-02-09: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for…
• CVE-2022-22540 - CVSS 7.5 (high), 2022-02-09: SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted…
• CVE-2021-42067 - CVSS 4.3 (medium), 2022-01-14: In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a…
• CVE-2021-44231 - CVSS 9.8 (critical), 2021-12-14: Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An attacker could thereby control the…
• CVE-2021-44235 - CVSS 6.7 (medium), 2021-12-14: Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an…
• CVE-2021-40504 - CVSS 4.9 (medium), 2021-11-10: A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753,…
• CVE-2021-40496 - CVSS 4.3 (medium), 2021-10-12: SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attacker with logon…
• CVE-2021-40495 - CVSS 5.3 (medium), 2021-10-12: There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754,…
• CVE-2021-40499 - CVSS 9.8 (critical), 2021-10-12: Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, 7.70 BYD, allow an…
• CVE-2021-38181 - CVSS 7.5 (high), 2021-10-12: SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prevent legitimate…
• CVE-2021-38178 - CVSS 8.8 (high), 2021-10-12: The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756,…
• CVE-2021-33684 - CVSS 5.3 (medium), 2021-07-14: SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT,…
• CVE-2021-33678 - CVSS 6.5 (medium), 2021-07-14: A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C,…
• CVE-2021-33677 - CVSS 7.5 (high), 2021-07-14: SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead to information…
• CVE-2021-27610 - CVSS 9.8 (critical), 2021-06-16: SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal…
• CVE-2021-33663 - CVSS 5.8 (medium), 2021-06-09: SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC -…
• CVE-2021-33665 - CVSS 5.4 (medium), 2021-06-09: SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL -…
• CVE-2021-33664 - CVSS 5.4 (medium), 2021-06-09: SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not…
• CVE-2021-21490 - CVSS 6.1 (medium), 2021-06-09: SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output…
• CVE-2021-21473 - CVSS 6.3 (medium), 2021-06-09: SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module…
• CVE-2021-27611 - CVSS 8.2 (high), 2021-05-11: SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the…
• CVE-2021-27603 - CVSS 6.5 (medium), 2021-04-13: An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time.…
• CVE-2021-21446 - CVSS 7.5 (high), 2021-01-12: SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accessing a service,…
• CVE-2020-26835 - CVSS 6.1 (medium), 2020-12-09: SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in…
• CVE-2020-26832 - CVSS 7.6 (high), 2020-12-09: SAP AS ABAP (SAP Landscape Transformation), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4…
• CVE-2020-26819 - CVSS 8.8 (high), 2020-11-10: SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, that…
• CVE-2020-26818 - CVSS 8.8 (high), 2020-11-10: SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components,…
• CVE-2020-6371 - CVSS 4.3 (medium), 2020-10-15: User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application…
• CVE-2020-6296 - CVSS 8.8 (high), 2020-08-12: SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that…
• CVE-2020-6310 - CVSS 4.3 (medium), 2020-08-12: Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any…
• CVE-2020-6299 - CVSS 4.3 (medium), 2020-08-12: SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 740, 750, 751, 752, 753, 754, 755, allows a business user to access the list of users in the given…
• CVE-2020-6280 - CVSS 2.7 (low), 2020-07-14: SAP NetWeaver (ABAP Server) and ABAP Platform, versions 731, 740, 750, allows an attacker with admin privileges to access certain files which should otherwise…
• CVE-2020-6270 - CVSS 6.5 (medium), 2020-06-10: SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks…
• CVE-2020-6275 - CVSS 9.8 (critical), 2020-06-10: SAP Netweaver AS ABAP, versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, are vulnerable for Server Side Request Forgery Attack where…
• CVE-2020-6240 - CVSS 7.5 (high), 2020-05-12: SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticated attacker to…
• CVE-2019-0321 - CVSS 6.1 (medium), 2019-07-10: ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting…
• CVE-2019-0257 - CVSS 8.8 (high), 2019-02-15: Customizing functionality of SAP NetWeaver AS ABAP Platform (fixed in versions from 7.0 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.53, from…