{"schema_version":1,"title":"SAP SE vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in SAP SE: 0 in the last 7 days and 8 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-58246, was published on 28 July 2026.","url":"https://junglewise.ai/threats/vendors/sap-se","json_url":"https://junglewise.ai/threats/vendors/sap-se.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/sap-se","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":2,"all_time":9,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":8,"last_365_days":9},"latest":[{"cve":"CVE-2026-58246","cvss":4.3,"slug":"cve-2026-58246-sap-netweaver-as-abap-sensitive-information-exposure-in","title":"SAP NetWeaver AS ABAP sensitive information exposure in diagnostic trace","severity":"medium","exploited":false,"published_at":"2026-07-28T10:16:49.943+00:00","url":"https://junglewise.ai/threats/cve-2026-58246-sap-netweaver-as-abap-sensitive-information-exposure-in"},{"cve":"CVE-2026-58233","cvss":7.6,"slug":"cve-2026-58233-sap-change-and-transport-system-attach-tool-insecure","title":"SAP Change and Transport System Attach Tool insecure deserialization","severity":"high","exploited":false,"published_at":"2026-07-14T01:16:18.71+00:00","url":"https://junglewise.ai/threats/cve-2026-58233-sap-change-and-transport-system-attach-tool-insecure"},{"cve":"CVE-2026-44768","cvss":4.1,"slug":"cve-2026-44768-sap-crm-webclient-ui-script-injection-due-to-missing-csp","title":"SAP CRM WebClient UI script injection due to missing CSP","severity":"medium","exploited":false,"published_at":"2026-07-14T01:16:18.253+00:00","url":"https://junglewise.ai/threats/cve-2026-44768-sap-crm-webclient-ui-script-injection-due-to-missing-csp"},{"cve":"CVE-2026-44767","cvss":6.1,"slug":"cve-2026-44767-sap-ui5-web-components-css-injection-in-setthemeroot","title":"SAP UI5 Web Components CSS injection in setThemeRoot","severity":"medium","exploited":false,"published_at":"2026-07-14T01:16:18.14+00:00","url":"https://junglewise.ai/threats/cve-2026-44767-sap-ui5-web-components-css-injection-in-setthemeroot"},{"cve":"CVE-2026-44759","cvss":6.1,"slug":"cve-2026-44759-sap-netweaver-enterprise-portal-reflected-xss-in-url-parameter","title":"SAP NetWeaver Enterprise Portal reflected XSS in URL parameter","severity":"medium","exploited":false,"published_at":"2026-07-14T01:16:17.797+00:00","url":"https://junglewise.ai/threats/cve-2026-44759-sap-netweaver-enterprise-portal-reflected-xss-in-url-parameter"},{"cve":"CVE-2026-44753","cvss":3.7,"slug":"cve-2026-44753-sap-hana-database-user-enumeration-in-user-self-service-tools","title":"SAP HANA Database user enumeration in User Self Service tools","severity":"low","exploited":false,"published_at":"2026-07-14T01:16:17.683+00:00","url":"https://junglewise.ai/threats/cve-2026-44753-sap-hana-database-user-enumeration-in-user-self-service-tools"},{"cve":"CVE-2026-44745","cvss":8.1,"epss":0.0047,"slug":"cve-2026-44745-sap-approuter-open-redirect-in-oauth2-login-flow","title":"SAP Approuter open redirect in OAuth2 login flow","severity":"high","exploited":false,"published_at":"2026-07-14T01:16:17.32+00:00","url":"https://junglewise.ai/threats/cve-2026-44745-sap-approuter-open-redirect-in-oauth2-login-flow"},{"cve":"CVE-2026-27690","cvss":9.1,"epss":0.0068,"slug":"cve-2026-27690-sap-approuter-http-request-smuggling","title":"SAP Approuter HTTP request smuggling","severity":"critical","exploited":false,"published_at":"2026-07-14T01:16:17.193+00:00","url":"https://junglewise.ai/threats/cve-2026-27690-sap-approuter-http-request-smuggling"},{"cve":"CVE-2026-40129","cvss":4.3,"slug":"cve-2026-40129-sap-application-server-abap-code-injection-in-netweaver-and-abap","title":"SAP Application Server ABAP code injection in NetWeaver and ABAP Platform","severity":"medium","exploited":false,"published_at":"2026-05-12T03:16:11.783+00:00","url":"https://junglewise.ai/threats/cve-2026-40129-sap-application-server-abap-code-injection-in-netweaver-and-abap"}],"vendor":{"hub":true,"name":"SAP SE","slug":"sap-se","homepage":"https://www.sap.com/","description":"A German multinational software company that develops enterprise software to manage business operations and customer relations.","url":"https://junglewise.ai/threats/vendors/sap-se"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":1,"exploited":0,"vulnerabilities":7},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-27690","cvss":9.1,"epss":0.0068,"slug":"cve-2026-27690-sap-approuter-http-request-smuggling","title":"SAP Approuter HTTP request smuggling","severity":"critical","exploited":false,"published_at":"2026-07-14T01:16:17.193+00:00","url":"https://junglewise.ai/threats/cve-2026-27690-sap-approuter-http-request-smuggling"},{"cve":"CVE-2026-44745","cvss":8.1,"epss":0.0047,"slug":"cve-2026-44745-sap-approuter-open-redirect-in-oauth2-login-flow","title":"SAP Approuter open redirect in OAuth2 login flow","severity":"high","exploited":false,"published_at":"2026-07-14T01:16:17.32+00:00","url":"https://junglewise.ai/threats/cve-2026-44745-sap-approuter-open-redirect-in-oauth2-login-flow"},{"cve":"CVE-2026-58233","cvss":7.6,"slug":"cve-2026-58233-sap-change-and-transport-system-attach-tool-insecure","title":"SAP Change and Transport System Attach Tool insecure deserialization","severity":"high","exploited":false,"published_at":"2026-07-14T01:16:18.71+00:00","url":"https://junglewise.ai/threats/cve-2026-58233-sap-change-and-transport-system-attach-tool-insecure"},{"cve":"CVE-2026-44767","cvss":6.1,"slug":"cve-2026-44767-sap-ui5-web-components-css-injection-in-setthemeroot","title":"SAP UI5 Web Components CSS injection in setThemeRoot","severity":"medium","exploited":false,"published_at":"2026-07-14T01:16:18.14+00:00","url":"https://junglewise.ai/threats/cve-2026-44767-sap-ui5-web-components-css-injection-in-setthemeroot"},{"cve":"CVE-2026-44759","cvss":6.1,"slug":"cve-2026-44759-sap-netweaver-enterprise-portal-reflected-xss-in-url-parameter","title":"SAP NetWeaver Enterprise Portal reflected XSS in URL parameter","severity":"medium","exploited":false,"published_at":"2026-07-14T01:16:17.797+00:00","url":"https://junglewise.ai/threats/cve-2026-44759-sap-netweaver-enterprise-portal-reflected-xss-in-url-parameter"},{"cve":"CVE-2026-58246","cvss":4.3,"slug":"cve-2026-58246-sap-netweaver-as-abap-sensitive-information-exposure-in","title":"SAP NetWeaver AS ABAP sensitive information exposure in diagnostic trace","severity":"medium","exploited":false,"published_at":"2026-07-28T10:16:49.943+00:00","url":"https://junglewise.ai/threats/cve-2026-58246-sap-netweaver-as-abap-sensitive-information-exposure-in"},{"cve":"CVE-2026-40129","cvss":4.3,"slug":"cve-2026-40129-sap-application-server-abap-code-injection-in-netweaver-and-abap","title":"SAP Application Server ABAP code injection in NetWeaver and ABAP Platform","severity":"medium","exploited":false,"published_at":"2026-05-12T03:16:11.783+00:00","url":"https://junglewise.ai/threats/cve-2026-40129-sap-application-server-abap-code-injection-in-netweaver-and-abap"},{"cve":"CVE-2026-44768","cvss":4.1,"slug":"cve-2026-44768-sap-crm-webclient-ui-script-injection-due-to-missing-csp","title":"SAP CRM WebClient UI script injection due to missing CSP","severity":"medium","exploited":false,"published_at":"2026-07-14T01:16:18.253+00:00","url":"https://junglewise.ai/threats/cve-2026-44768-sap-crm-webclient-ui-script-injection-due-to-missing-csp"},{"cve":"CVE-2026-44753","cvss":3.7,"slug":"cve-2026-44753-sap-hana-database-user-enumeration-in-user-self-service-tools","title":"SAP HANA Database user enumeration in User Self Service tools","severity":"low","exploited":false,"published_at":"2026-07-14T01:16:17.683+00:00","url":"https://junglewise.ai/threats/cve-2026-44753-sap-hana-database-user-enumeration-in-user-self-service-tools"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[]}