# SAP NetWeaver vulnerabilities Source: https://junglewise.ai/threats/technologies/netweaver Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/netweaver.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in SAP NetWeaver: 8 in the last 7 days and 11 in the last 90 days, 12 of them critical and 10 exploited in the wild. The most recent, CVE-2026-76973, was published on 10 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 8 - Last 30 days: 8 - Last 90 days: 11 - All time: 22 (12 critical, 10 exploited in the wild) ## About SAP NetWeaver SAP application platform for enterprise resource planning and business applications. ## Latest SAP NetWeaver vulnerabilities - [CVE-2026-76973: SAP NetWeaver Application Server ABAP memory corruption denial of service](https://junglewise.ai/threats/cve-2026-76973-due-to-a-memory-corruption-vulnerability-in-application-server) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-76966: SAP NetWeaver ABAP RFC protocol memory corruption](https://junglewise.ai/threats/cve-2026-76966-due-to-improper-rfc-protocol-validation-in-the-sap-kernel-used-by) (high, CVSS 8.9, published 10 Nov 2026) - [CVE-2026-120008: SAP NetWeaver Internet Graphics Service input validation buffer overflow](https://junglewise.ai/threats/cve-2026-120008-sap-netweaver-internet-graphics-service-does-not-sufficiently) (high, CVSS 8.2, published 10 Nov 2026) - [CVE-2026-109811: SAP NetWeaver SSRF in ABAP HTTP component](https://junglewise.ai/threats/cve-2026-109811-an-internal-abap-http-component-in-sap-netweaver-and-abap) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-109807: SAP NetWeaver Internet Graphics Service input validation denial of service](https://junglewise.ai/threats/cve-2026-109807-sap-netweaver-internet-graphics-service-does-not-sufficiently) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-109806: SAP NetWeaver Internet Graphics Service integer overflow](https://junglewise.ai/threats/cve-2026-109806-sap-netweaver-internet-graphics-service-does-not-sufficiently) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-109805: SAP NetWeaver HMAC cryptography weakness in RFC callback](https://junglewise.ai/threats/cve-2026-109805-due-to-a-weak-hmac-cryptography-calculation-when-receiving-an) (medium, CVSS 6.4, published 10 Nov 2026) - [CVE-2026-109795: SAP NetWeaver insufficient authorization checks and input validation](https://junglewise.ai/threats/cve-2026-109795-sap-netweaver-does-not-perform-necessary-authorization-checks) (critical, CVSS 9.9, published 10 Nov 2026) - [CVE-2026-58249: SAP NetWeaver and Web Dispatcher input validation vulnerability](https://junglewise.ai/threats/cve-2026-58249-sap-netweaver-and-sap-web-dispatcher-do-not-properly-validate) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-76963: SAP NetWeaver authorization bypass in Application Server ABAP](https://junglewise.ai/threats/cve-2026-76963-sap-netweaver-authorization-bypass-in-application-server-abap) (medium, CVSS 4.3, published 8 Sep 2026) - [CVE-2026-58240: SAP NetWeaver Message Server authentication bypass in component registration](https://junglewise.ai/threats/cve-2026-58240-sap-netweaver-message-server-authentication-bypass-in-component) (critical, CVSS 9.8, published 8 Sep 2026) - [CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability](https://junglewise.ai/threats/cve-2025-42999-sap-netweaver-deserialization-vulnerability) (critical, exploited in the wild, CVSS 9.1, published 15 May 2025) - [CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability](https://junglewise.ai/threats/cve-2025-31324-sap-netweaver-unrestricted-file-upload-vulnerability) (critical, exploited in the wild, CVSS 10, published 29 Apr 2025) - [CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability](https://junglewise.ai/threats/cve-2017-12637-sap-netweaver-directory-traversal-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 19 Mar 2025) - [CVE-2021-38163: SAP NetWeaver Unrestricted File Upload Vulnerability](https://junglewise.ai/threats/cve-2021-38163-sap-netweaver-unrestricted-file-upload-vulnerability) (critical, exploited in the wild, CVSS 9.9, published 9 Jun 2022) - [CVE-2016-2386: SAP NetWeaver SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2016-2386-sap-netweaver-sql-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 9 Jun 2022) - [CVE-2016-2388: SAP NetWeaver Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2016-2388-sap-netweaver-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 9 Jun 2022) - [CVE-2016-9563: SAP NetWeaver XML External Entity (XXE) Vulnerability](https://junglewise.ai/threats/cve-2016-9563-sap-netweaver-xml-external-entity-xxe-vulnerability) (critical, exploited in the wild, CVSS 6.5, published 3 Nov 2021) - [CVE-2010-5326: SAP NetWeaver Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2010-5326-sap-netweaver-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 10, published 3 Nov 2021) - [CVE-2016-3976: SAP NetWeaver Directory Traversal Vulnerability](https://junglewise.ai/threats/cve-2016-3976-sap-netweaver-directory-traversal-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 3 Nov 2021) - [CVE-2020-6287: SAP NetWeaver Missing Authentication for Critical Function Vulnerability](https://junglewise.ai/threats/cve-2020-6287-sap-netweaver-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 10, published 3 Nov 2021) - [CVE-2017-5372: SAP NetWeaver AS JAVA information disclosure in P4 SERVERCORE](https://junglewise.ai/threats/cve-2017-5372-sap-netweaver-as-java-information-disclosure-in-p4-servercore) (high, CVSS 7.5, published 23 Jan 2017) ## Most severe SAP NetWeaver vulnerabilities - [CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability](https://junglewise.ai/threats/cve-2025-31324-sap-netweaver-unrestricted-file-upload-vulnerability) (critical, exploited in the wild, CVSS 10, published 29 Apr 2025) - [CVE-2010-5326: SAP NetWeaver Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2010-5326-sap-netweaver-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 10, published 3 Nov 2021) - [CVE-2020-6287: SAP NetWeaver Missing Authentication for Critical Function Vulnerability](https://junglewise.ai/threats/cve-2020-6287-sap-netweaver-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 10, published 3 Nov 2021) - [CVE-2021-38163: SAP NetWeaver Unrestricted File Upload Vulnerability](https://junglewise.ai/threats/cve-2021-38163-sap-netweaver-unrestricted-file-upload-vulnerability) (critical, exploited in the wild, CVSS 9.9, published 9 Jun 2022) - [CVE-2016-2386: SAP NetWeaver SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2016-2386-sap-netweaver-sql-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 9 Jun 2022) - [CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability](https://junglewise.ai/threats/cve-2025-42999-sap-netweaver-deserialization-vulnerability) (critical, exploited in the wild, CVSS 9.1, published 15 May 2025) - [CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability](https://junglewise.ai/threats/cve-2017-12637-sap-netweaver-directory-traversal-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 19 Mar 2025) - [CVE-2016-3976: SAP NetWeaver Directory Traversal Vulnerability](https://junglewise.ai/threats/cve-2016-3976-sap-netweaver-directory-traversal-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 3 Nov 2021) - [CVE-2016-9563: SAP NetWeaver XML External Entity (XXE) Vulnerability](https://junglewise.ai/threats/cve-2016-9563-sap-netweaver-xml-external-entity-xxe-vulnerability) (critical, exploited in the wild, CVSS 6.5, published 3 Nov 2021) - [CVE-2016-2388: SAP NetWeaver Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2016-2388-sap-netweaver-information-disclosure-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 9 Jun 2022) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 2 | 1 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 8 | 1 | 0 | ## Other SAP technologies - [SAP NetWeaver Application Server ABAP](https://junglewise.ai/threats/technologies/netweaver-application-server-abap): 19 vulnerabilities - [SAP NetWeaver Application Server Java](https://junglewise.ai/threats/technologies/netweaver-as-java-servercore): 14 vulnerabilities - [SAP ABAP Platform](https://junglewise.ai/threats/technologies/sap-abap-platform): 10 vulnerabilities - [SAP Manufacturing Integration and Intelligence](https://junglewise.ai/threats/technologies/manufacturing-integration-and-intelligence): 8 vulnerabilities - [SAP Web Dispatcher](https://junglewise.ai/threats/technologies/web-dispatcher): 8 vulnerabilities - [SAP NetWeaver Application Server for ABAP](https://junglewise.ai/threats/technologies/netweaver-application-server-for-abap): 7 vulnerabilities - [SAP S/4HANA](https://junglewise.ai/threats/technologies/s-4hana): 7 vulnerabilities - [SAP Businessobjects-Bi-Platform](https://junglewise.ai/threats/technologies/businessobjects-business-intelligence-platform): 6 vulnerabilities - [SAP Business Connector](https://junglewise.ai/threats/technologies/business-connector): 4 vulnerabilities - [SAP Commerce Cloud](https://junglewise.ai/threats/technologies/commerce-cloud): 4 vulnerabilities - [SAP NetWeaver Enterprise Portal](https://junglewise.ai/threats/technologies/sap-netweaver-enterprise-portal): 4 vulnerabilities - [SAP Cloud SDK for Python](https://junglewise.ai/threats/technologies/cloud-sdk-for-python): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "SAP NetWeaver vulnerabilities", https://junglewise.ai/threats/technologies/netweaver, 12 November 2026.