# SAP vulnerabilities Source: https://junglewise.ai/threats/vendors/sap Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/sap.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 159 vulnerabilities in SAP: 40 in the last 7 days and 76 in the last 90 days, 41 of them critical and 14 exploited in the wild. The most recent, CVE-2026-120013, was published on 10 November 2026. 18 vulnerabilities in the last four weeks, up 1700% on the four before (1). 4 critical against 0. 16 technologies have a page of their own. ## Counts - Last 7 days: 40 - Last 30 days: 40 - Last 90 days: 76 - All time: 159 (41 critical, 14 exploited in the wild) ## About SAP SAP is a multinational software corporation that develops enterprise software to manage business operations and customer relations. ## Latest SAP vulnerabilities - [CVE-2026-120013: SAP Cloud SDK for Python path traversal in agent_memory module](https://junglewise.ai/threats/cve-2026-120013-the-agent-memory-module-accepts-a-caller-supplied-tenant) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-120012: SAP Cloud SDK for AI (Node.js) sensitive credentials in error messages](https://junglewise.ai/threats/cve-2026-120012-sap-cloud-sdk-for-ai-node-js-could-inadvertently-include) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-89131: SAP NetWeaver Enterprise Portal CSRF in server-side actions](https://junglewise.ai/threats/cve-2026-89131-sap-netweaver-enterprise-portal-does-not-sufficiently-protect) (medium, CVSS 4.3, published 10 Nov 2026) - [CVE-2026-89129: SAP NetWeaver AS Java Web Services SSRF](https://junglewise.ai/threats/cve-2026-89129-due-to-a-server-side-request-forgery-ssrf-vulnerability-in-sap) (medium, CVSS 5.8, published 10 Nov 2026) - [CVE-2026-89128: SAP NetWeaver AS Java broken access control in SOAP operations](https://junglewise.ai/threats/cve-2026-89128-due-to-broken-access-control-in-sap-netweaver-as-java-an) (medium, CVSS 5.3, published 10 Nov 2026) - [CVE-2026-89126: SAP Web Dispatcher input validation memory corruption](https://junglewise.ai/threats/cve-2026-89126-sap-web-dispatcher-does-not-sufficiently-validate-certain-network) (critical, CVSS 10, published 10 Nov 2026) - [CVE-2026-89125: SAP Web Dispatcher and Internet Communication Manager insecure sensitive information storage](https://junglewise.ai/threats/cve-2026-89125-due-to-insecure-storage-of-sensitive-information-in-sap-web) (medium, CVSS 6, published 10 Nov 2026) - [CVE-2026-89119: SAP Web Dispatcher and NetWeaver Application Server ABAP CSRF in administrative functionality](https://junglewise.ai/threats/cve-2026-89119-sap-web-dispatcher-and-sap-netweaver-application-server-abap) (critical, CVSS 9.6, published 10 Nov 2026) - [CVE-2026-89115: SAP Start Service and SAP Management Console credential exposure](https://junglewise.ai/threats/cve-2026-89115-sap-start-service-and-sap-management-console-store-sensitive) (medium, CVSS 4.4, published 10 Nov 2026) - [CVE-2026-89114: SAP NetWeaver AS Java EDM Application authentication bypass in web service](https://junglewise.ai/threats/cve-2026-89114-sap-netweaver-as-java-edm-application-does-not-perform-an) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-89103: SAP Gateway default ACL authentication bypass](https://junglewise.ai/threats/cve-2026-89103-sap-gateway-activates-the-default-access-control-list-with-high) (critical, CVSS 10, published 10 Nov 2026) - [CVE-2026-76973: SAP NetWeaver Application Server ABAP memory corruption denial of service](https://junglewise.ai/threats/cve-2026-76973-due-to-a-memory-corruption-vulnerability-in-application-server) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-76970: SAP NetWeaver Application Server ABAP memory corruption denial of service](https://junglewise.ai/threats/cve-2026-76970-due-to-a-memory-corruption-vulnerability-in-application-server) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-76966: SAP NetWeaver ABAP RFC protocol memory corruption](https://junglewise.ai/threats/cve-2026-76966-due-to-improper-rfc-protocol-validation-in-the-sap-kernel-used-by) (high, CVSS 8.9, published 10 Nov 2026) - [CVE-2026-76965: SAP NetWeaver Application Server ABAP authorization bypass](https://junglewise.ai/threats/cve-2026-76965-sap-netweaver-application-server-abap-and-abap-platform-does-not) (critical, CVSS 9.9, published 10 Nov 2026) - [CVE-2026-76964: SAP NetWeaver Application Server ABAP memory corruption](https://junglewise.ai/threats/cve-2026-76964-sap-netweaver-application-server-abap-does-not-sufficiently) (critical, CVSS 10, published 10 Nov 2026) - [CVE-2026-120017: SAP NetWeaver AS ABAP authentication assertion verification bypass](https://junglewise.ai/threats/cve-2026-120017-sap-netweaver-as-abap-and-abap-platform-does-not-perform) (critical, CVSS 10, published 10 Nov 2026) - [CVE-2026-120016: SAP NetWeaver Visual Composer cross-site scripting](https://junglewise.ai/threats/cve-2026-120016-sap-netweaver-visual-composer-does-not-perform-sufficient-input) (medium, CVSS 6.1, published 10 Nov 2026) - [CVE-2026-120014: SAP HANA XSA Web Dispatcher CSRF in administrative functionality](https://junglewise.ai/threats/cve-2026-120014-sap-hana-xsa-web-dispatcher-does-not-perform-sufficient-request) (high, CVSS 7.6, published 10 Nov 2026) - [CVE-2026-120010: SAP NetWeaver Application Server heap buffer overflow in Message Server](https://junglewise.ai/threats/cve-2026-120010-sap-netweaver-application-server-sap-message-server-does-not) (high, CVSS 7.5, published 10 Nov 2026) - [CVE-2026-120009: SAP ABAP Developer Tools code injection in AMDP Data Preview](https://junglewise.ai/threats/cve-2026-120009-sap-abap-developer-tools-amdp-data-preview-does-not-perform) (high, CVSS 7.2, published 10 Nov 2026) - [CVE-2026-120008: SAP NetWeaver Internet Graphics Service input validation buffer overflow](https://junglewise.ai/threats/cve-2026-120008-sap-netweaver-internet-graphics-service-does-not-sufficiently) (high, CVSS 8.2, published 10 Nov 2026) - [CVE-2026-109811: SAP NetWeaver SSRF in ABAP HTTP component](https://junglewise.ai/threats/cve-2026-109811-an-internal-abap-http-component-in-sap-netweaver-and-abap) (medium, CVSS 6.5, published 10 Nov 2026) - [CVE-2026-109810: SAP NetWeaver Application Server Java path traversal in Web Dynpro styling](https://junglewise.ai/threats/cve-2026-109810-sap-netweaver-application-server-java-web-dynpro-java-does-not) (medium, CVSS 6.1, published 10 Nov 2026) - [CVE-2026-109809: SAP NetWeaver Application Server Java authorization bypass in NWDI Cockpit](https://junglewise.ai/threats/cve-2026-109809-sap-netweaver-application-server-java-nwdi-cockpit-does-not) (medium, CVSS 6.5, published 10 Nov 2026) ## Most severe SAP vulnerabilities - [CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability](https://junglewise.ai/threats/cve-2025-31324-sap-netweaver-unrestricted-file-upload-vulnerability) (critical, exploited in the wild, CVSS 10, published 29 Apr 2025) - [CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerability](https://junglewise.ai/threats/cve-2022-22536-sap-multiple-products-http-request-smuggling-vulnerability) (critical, exploited in the wild, CVSS 10, published 18 Aug 2022) - [CVE-2010-5326: SAP NetWeaver Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2010-5326-sap-netweaver-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 10, published 3 Nov 2021) - [CVE-2020-6207: SAP Solution Manager Missing Authentication for Critical Function Vulnerability](https://junglewise.ai/threats/cve-2020-6207-sap-solution-manager-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 10, published 3 Nov 2021) - [CVE-2020-6287: SAP NetWeaver Missing Authentication for Critical Function Vulnerability](https://junglewise.ai/threats/cve-2020-6287-sap-netweaver-missing-authentication-for-critical-function) (critical, exploited in the wild, CVSS 10, published 3 Nov 2021) - [CVE-2021-38163: SAP NetWeaver Unrestricted File Upload Vulnerability](https://junglewise.ai/threats/cve-2021-38163-sap-netweaver-unrestricted-file-upload-vulnerability) (critical, exploited in the wild, CVSS 9.9, published 9 Jun 2022) - [CVE-2019-0344: SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability](https://junglewise.ai/threats/cve-2019-0344-sap-commerce-cloud-deserialization-of-untrusted-data-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 30 Sep 2024) - [CVE-2016-2386: SAP NetWeaver SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2016-2386-sap-netweaver-sql-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 9 Jun 2022) - [CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability](https://junglewise.ai/threats/cve-2025-42999-sap-netweaver-deserialization-vulnerability) (critical, exploited in the wild, CVSS 9.1, published 15 May 2025) - [CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability](https://junglewise.ai/threats/cve-2017-12637-sap-netweaver-directory-traversal-vulnerability) (critical, exploited in the wild, CVSS 7.5, published 19 Mar 2025) ## Vulnerabilities per week 18 vulnerabilities in the last four weeks, up 1700% on the four before (1). 4 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 16 | 4 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 18 | 4 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 40 | 9 | 0 | ## SAP technologies - [SAP NetWeaver](https://junglewise.ai/threats/technologies/netweaver): 22 vulnerabilities - [SAP NetWeaver Application Server ABAP](https://junglewise.ai/threats/technologies/netweaver-application-server-abap): 19 vulnerabilities - [SAP NetWeaver Application Server Java](https://junglewise.ai/threats/technologies/netweaver-as-java-servercore): 14 vulnerabilities - [SAP ABAP Platform](https://junglewise.ai/threats/technologies/sap-abap-platform): 10 vulnerabilities - [SAP Manufacturing Integration and Intelligence](https://junglewise.ai/threats/technologies/manufacturing-integration-and-intelligence): 8 vulnerabilities - [SAP Web Dispatcher](https://junglewise.ai/threats/technologies/web-dispatcher): 8 vulnerabilities - [SAP NetWeaver Application Server for ABAP](https://junglewise.ai/threats/technologies/netweaver-application-server-for-abap): 7 vulnerabilities - [SAP S/4HANA](https://junglewise.ai/threats/technologies/s-4hana): 7 vulnerabilities - [SAP Businessobjects-Bi-Platform](https://junglewise.ai/threats/technologies/businessobjects-business-intelligence-platform): 6 vulnerabilities - [SAP Business Connector](https://junglewise.ai/threats/technologies/business-connector): 4 vulnerabilities - [SAP Commerce Cloud](https://junglewise.ai/threats/technologies/commerce-cloud): 4 vulnerabilities - [SAP NetWeaver Enterprise Portal](https://junglewise.ai/threats/technologies/sap-netweaver-enterprise-portal): 4 vulnerabilities - [SAP Cloud SDK for Python](https://junglewise.ai/threats/technologies/cloud-sdk-for-python): 3 vulnerabilities - [SAP NetWeaver AS Java](https://junglewise.ai/threats/technologies/netweaver-as-java): 3 vulnerabilities - [SAP S/4HANA Finance](https://junglewise.ai/threats/technologies/s-4hana-finance): 3 vulnerabilities - [SAP Sqlite](https://junglewise.ai/threats/technologies/sqlite): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "SAP vulnerabilities", https://junglewise.ai/threats/vendors/sap, 12 November 2026.