Known Vulnerabilities for products from SAP
Listed below are 20 of the newest known vulnerabilities associated with the vendor "SAP".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-66778 json | SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An una... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-66777 json | SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-66776 json | SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific ... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-66775 json | SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticate... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-66774 json | SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-66761 json | SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send h... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-66760 json | SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, hol... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-58238 json | SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-58237 json | WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low pr... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-58230 json | SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker... | Not Provided | 2026-08-11 | 2026-09-08 |
| CVE-2026-44745 json | SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. ... | Not Provided | 2026-07-14 | 2026-09-08 |
| CVE-2026-40135 json | An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows a... | Not Provided | 2026-05-12 | 2026-06-03 |
| CVE-2026-34264 json | During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to thi... | Not Provided | 2026-04-14 | 2026-05-04 |
| CVE-2026-34262 json | Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer | Not Provided | 2026-04-14 | 2026-05-04 |
| CVE-2026-34257 json | Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malic... | Not Provided | 2026-04-14 | 2026-06-03 |
| CVE-2026-27690 json | Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted H... | Not Provided | 2026-07-14 | 2026-09-08 |
| CVE-2026-27688 json | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privil... | Not Provided | 2026-03-10 | 2026-06-03 |
| CVE-2026-27682 json | Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on B... | Not Provided | 2026-05-12 | 2026-06-03 |
| CVE-2026-27680 json | Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject c... | Not Provided | 2026-05-14 | 2026-06-03 |
| CVE-2026-27679 json | Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker coul... | Not Provided | 2026-04-14 | 2026-05-04 |
Known software with vulnerabilities from SAP
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Sap | 3d Visual Enterprise Viewer | - |
| Application | Sap | Abap Platform | 7.31 |
| Application | Sap | Activex Viewer | 1.0.0 |
| Application | Sap | Adaptive Extensions | 1.0 |
| Application | Sap | Adaptive Server Enterprise | 15.7 |
| Application | Sap | Adaptive Server Enterprise Backup Server | 16.0 |
| Application | Sap | Adaptive Server Enterprise Cockpit | 16.0 |
| Application | Sap | Adminadapter | - |
| Application | Sap | Afaria | 7.0 |
| Application | Sap | Agentry Sdk | 7.1 |
| Application | Sap | Application Server | 2008_1_46c |
| Application | Sap | Application Server Java | 7.2 |
| Application | Sap | Background Processing | - |
| Application | Sap | Banking Services | 400 |
| Application | Sap | Bank Analyzer | 500 |
| Application | Sap | Basis | 7.0 |
| Application | Sap | Basis Communication Services | 4.6 |
| Application | Sap | Bi Launchpad | - |
| Application | Sap | Bi Universal Data Integration | - |
| Application | Sap | Businessobjects | - |