SAP_SE has 39 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 38 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 20. The median CVSS is 6.1 (medium), with 8 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (5) and CWE-862 (5). Most affected products: SAP NetWeaver Enterprise Portal (3), SAP S/4HANA (Finance for Advanced Payment Management) (3), SAP Manufacturing Integration and Intelligence (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 38 prev 0
Weakness classes
Products
- SAP NetWeaver Enterprise Portal 3
- SAP S/4HANA (Finance for Advanced Payment Management) 3
- SAP Manufacturing Integration and Intelligence 2
- CLA-Assistant 1
- SAP ABAP Platform 1
- SAP Cloud 1
Worst active — by depth score
CVE-2026-89111Critical· 10.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications55CVE-2026-89110Critical· 9.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality55CVE-2026-89107Critical· 9.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language55CVE-2026-44756Critical· 10.0A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library55CVE-2026-58240Critical· 9.8SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration54
SAP_SE vulnerabilities
CVEs affecting SAP_SE, newest first. Open any entry for full detail, references, and exploit status.
39 CVEsRSS
CVE-2026-89124Medium· 4.3Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their in…
Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their in…
CVE-2026-89122Medium· 6.1SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the tru…
CVE-2026-89121Medium· 4.7SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data
SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization…
CVE-2026-89120High· 7.1A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit t…
CVE-2026-89118Medium· 5.3SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Av…
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Av…
CVE-2026-89117Medium· 6.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leadi…
CVE-2026-89116Medium· 5.9The affected code used child_process.execSync with a shell string for generator installation and uninstallation
The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWiz…
CVE-2026-89113High· 8.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL …
CVE-2026-89112Medium· 6.5The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privilege…
The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privilege…
CVE-2026-89111Critical· 10.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, caus…
CVE-2026-89110Critical· 9.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote co…
CVE-2026-89108Critical· 9.1SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to …
CVE-2026-89107Critical· 9.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privi…
CVE-2026-89106Medium· 4.4SAP UI5 does not perform sufficient input validation under certain configurations
SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact o…
CVE-2026-89105Medium· 4.2The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access
The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to g…
CVE-2026-76976Medium· 5.4Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If…
CVE-2026-76975Medium· 6.1Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible
Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-co…
CVE-2026-76972Medium· 6.5Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application
Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that dis…
CVE-2026-58249High· 7.5PoCSAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handl…
CVE-2026-58242Low· 3.5SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests
SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitat…
CVE-2026-76974Medium· 5.3SAP Fiori Launchpad does not sufficiently validate certain user-controlled input
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled conten…
CVE-2026-76977Medium· 4.3SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's p…
CVE-2026-76971Medium· 6.5Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could…
CVE-2026-76969Critical· 9.4@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive …
CVE-2026-76968Medium· 6.5SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state…
SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state…
CVE-2026-76967High· 7.8SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially craft…
CVE-2026-76963Medium· 4.3Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information
Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could res…
CVE-2026-76962Medium· 4.3SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality
SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not…
CVE-2026-76961Low· 3.5SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticate…
CVE-2026-76960Low· 3.5SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page
SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticate…