{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: SAP vulnerabilities","home_page_url":"https://patchfirst.co/vendor/sap/","feed_url":"https://patchfirst.co/feed/vendor/sap.json","description":"New and newly exploited SAP CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-89107","url":"https://patchfirst.co/cve/CVE-2026-89107/","title":"CVE-2026-89107: SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition…","content_text":"SAP_SE · SAP S/4HANA (Manage Substitution/Validation Rules). Not in CISA KEV. EPSS 0.5% (higher than 41.5% of CVEs). CVSS 9.9 CRITICAL. Priority 17.4 of 100.","summary":"SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T20:38:04.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.4,"kev":null,"epss":{"score":0.00481,"percentile":0.41461},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP_SE","product":"SAP S/4HANA (Manage Substitution/Validation Rules)","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-89110","url":"https://patchfirst.co/cve/CVE-2026-89110/","title":"CVE-2026-89110: SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality","content_text":"SAP_SE · SAP NetWeaver Visual Composer. Not in CISA KEV. EPSS 0.4% (higher than 34.3% of CVEs). CVSS 9.9 CRITICAL. Priority 16.0 of 100.","summary":"SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T20:38:04.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16,"kev":null,"epss":{"score":0.00401,"percentile":0.34304},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP_SE","product":"SAP NetWeaver Visual Composer","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-89111","url":"https://patchfirst.co/cve/CVE-2026-89111/","title":"CVE-2026-89111: The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications","content_text":"SAP_SE · SAP Cloud. Not in CISA KEV. EPSS 0.4% (higher than 31.2% of CVEs). CVSS 10.0 CRITICAL. Priority 15.4 of 100.","summary":"The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-30T18:18:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.4,"kev":null,"epss":{"score":0.00372,"percentile":0.31188},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP_SE","product":"SAP Cloud","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-89108","url":"https://patchfirst.co/cve/CVE-2026-89108/","title":"CVE-2026-89108: SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain…","content_text":"SAP_SE · SAP Manufacturing Integration and Intelligence (Configuration Service). Not in CISA KEV. EPSS 0.4% (higher than 32.7% of CVEs). CVSS 9.1 CRITICAL. Priority 15.1 of 100.","summary":"SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain…","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T20:38:04.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.1,"kev":null,"epss":{"score":0.00386,"percentile":0.32687},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP_SE","product":"SAP Manufacturing Integration and Intelligence (Configuration Service)","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-58231","url":"https://patchfirst.co/cve/CVE-2026-58231/","title":"CVE-2026-58231: Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)","content_text":"SAP_SE · SAP Commerce Cloud (Data Hub Adapter). Not in CISA KEV. EPSS 0.9% (higher than 58.3% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 71.5 of 100.","summary":"Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)","date_published":"2026-08-11T00:00:00.000Z","date_modified":"2026-08-12T03:59:57.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":71.5,"kev":null,"epss":{"score":0.00855,"percentile":0.58328},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP_SE","product":"SAP Commerce Cloud (Data Hub Adapter)","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-42957","url":"https://patchfirst.co/cve/CVE-2025-42957/","title":"CVE-2025-42957: Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)","content_text":"SAP_SE · SAP S/4HANA (Private Cloud or On-Premise). Not in CISA KEV. EPSS 1.6% (higher than 76.4% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 63.8 of 100.","summary":"Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)","date_published":"2025-08-12T00:00:00.000Z","date_modified":"2026-02-26T17:49:43.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":63.8,"kev":null,"epss":{"score":0.01645,"percentile":0.76427},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP_SE","product":"SAP S/4HANA (Private Cloud or On-Premise)","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-42999#kev","url":"https://patchfirst.co/cve/CVE-2025-42999/","title":"[KEV] CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2025-05-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 12.9% (higher than 96.3% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 78.6 of 100.","summary":"SAP NetWeaver Deserialization Vulnerability","date_published":"2025-05-15T00:00:00.000Z","date_modified":"2026-08-11T04:17:17.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1505.003"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2025-05-15","ransomware":true},"epss":{"score":0.12854,"percentile":0.96292},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1059","T1505.003"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-31324#kev","url":"https://patchfirst.co/cve/CVE-2025-31324/","title":"[KEV] CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2025-04-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1505.003 Web Shell; T1059 Command and Scripting Interpreter; T1602 Data from Configuration Repository. Named in 1 threat report. Priority 83.7 of 100.","summary":"SAP NetWeaver Unrestricted File Upload Vulnerability","date_published":"2025-04-29T00:00:00.000Z","date_modified":"2026-08-04T05:16:34.000Z","tags":["kev","ransomware","public-exploit","T1055","T1505.003","T1059","T1602"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2025-04-29","ransomware":true},"epss":{"score":0.99486,"percentile":0.99944},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1055","T1505.003","T1059","T1602"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2017-12637#kev","url":"https://patchfirst.co/cve/CVE-2017-12637/","title":"[KEV] CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2025-03-19. ENISA EUVD lists it as exploited. EPSS 95.1% (higher than 99.86% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1083 File and Directory Discovery; T1555 Credentials from Password Stores; T1592 Gather Victim Host Information. Priority 68.2 of 100.","summary":"SAP NetWeaver Directory Traversal Vulnerability","date_published":"2025-03-19T00:00:00.000Z","date_modified":"2026-06-17T01:03:42.000Z","tags":["kev","public-exploit","T1190","T1083","T1555","T1592"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2025-03-19","ransomware":false},"epss":{"score":0.95111,"percentile":0.99863},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1083","T1555","T1592"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-0344#kev","url":"https://patchfirst.co/cve/CVE-2019-0344/","title":"[KEV] CVE-2019-0344: SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability","content_text":"SAP · Commerce Cloud. In CISA KEV since 2024-09-30. ENISA EUVD lists it as exploited. EPSS 7.5% (higher than 94.5% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 63.8 of 100.","summary":"SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability","date_published":"2024-09-30T00:00:00.000Z","date_modified":"2026-06-17T02:08:12.000Z","tags":["kev","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":63.8,"kev":{"dateAdded":"2024-09-30","ransomware":false},"epss":{"score":0.07469,"percentile":0.94461},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"Commerce Cloud","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2024-41730","url":"https://patchfirst.co/cve/CVE-2024-41730/","title":"CVE-2024-41730: Missing Authentication check in SAP BusinessObjects Business Intelligence Platform","content_text":"SAP_SE · SAP BusinessObjects Business Intelligence Platform. Not in CISA KEV. EPSS 75.9% (higher than 99.53% of CVEs). CVSS 9.8 CRITICAL. Priority 28.1 of 100.","summary":"Missing Authentication check in SAP BusinessObjects Business Intelligence Platform","date_published":"2024-08-13T00:00:00.000Z","date_modified":"2024-08-16T04:01:44.000Z","tags":[],"_patchfirst":{"reason":"published","priority":28.1,"kev":null,"epss":{"score":0.75866,"percentile":0.99526},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP_SE","product":"SAP BusinessObjects Business Intelligence Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-22536#kev","url":"https://patchfirst.co/cve/CVE-2022-22536/","title":"[KEV] CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerability","content_text":"SAP · Multiple Products. In CISA KEV since 2022-08-18. ENISA EUVD lists it as exploited. EPSS 97.9% (higher than 99.91% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1557 Adversary-in-the-Middle. Priority 70.0 of 100.","summary":"SAP Multiple Products HTTP Request Smuggling Vulnerability","date_published":"2022-08-18T00:00:00.000Z","date_modified":"2026-06-17T04:28:33.000Z","tags":["kev","public-exploit","T1190","T1557"],"_patchfirst":{"reason":"kev","priority":70,"kev":{"dateAdded":"2022-08-18","ransomware":false},"epss":{"score":0.97945,"percentile":0.99909},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"Multiple Products","techniqueIds":["T1190","T1557"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-2386#kev","url":"https://patchfirst.co/cve/CVE-2016-2386/","title":"[KEV] CVE-2016-2386: SAP NetWeaver SQL Injection Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2022-06-09. ENISA EUVD lists it as exploited. EPSS 71.5% (higher than 99.42% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.7 of 100.","summary":"SAP NetWeaver SQL Injection Vulnerability","date_published":"2022-06-09T00:00:00.000Z","date_modified":"2026-06-17T00:43:56.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.7,"kev":{"dateAdded":"2022-06-09","ransomware":false},"epss":{"score":0.71522,"percentile":0.99416},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-38163#kev","url":"https://patchfirst.co/cve/CVE-2021-38163/","title":"[KEV] CVE-2021-38163: SAP NetWeaver Unrestricted File Upload Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2022-06-09. ENISA EUVD lists it as exploited. EPSS 36.9% (higher than 98.5% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 68.9 of 100.","summary":"SAP NetWeaver Unrestricted File Upload Vulnerability","date_published":"2022-06-09T00:00:00.000Z","date_modified":"2026-06-17T04:01:38.000Z","tags":["kev","public-exploit","T1078","T1059"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2022-06-09","ransomware":false},"epss":{"score":0.36898,"percentile":0.98507},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1078","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-2388#kev","url":"https://patchfirst.co/cve/CVE-2016-2388/","title":"[KEV] CVE-2016-2388: SAP NetWeaver Information Disclosure Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2022-06-09. ENISA EUVD lists it as exploited. EPSS 52.2% (higher than 99% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 66.5 of 100.","summary":"SAP NetWeaver Information Disclosure Vulnerability","date_published":"2022-06-09T00:00:00.000Z","date_modified":"2026-06-17T00:43:57.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":66.5,"kev":{"dateAdded":"2022-06-09","ransomware":false},"epss":{"score":0.52206,"percentile":0.98958},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-42063","url":"https://patchfirst.co/cve/CVE-2021-42063/","title":"CVE-2021-42063: A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50","content_text":"SAP SE · SAP Knowledge Warehouse. Not in CISA KEV. EPSS 23.4% (higher than 97.8% of CVEs). Public exploit code exists. Priority 59.6 of 100.","summary":"A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50","date_published":"2021-12-14T00:00:00.000Z","date_modified":"2024-08-04T03:22:25.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":59.6,"kev":null,"epss":{"score":0.23396,"percentile":0.97783},"cvss":null,"vendor":"SAP SE","product":"SAP Knowledge Warehouse","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-2380#kev","url":"https://patchfirst.co/cve/CVE-2018-2380/","title":"[KEV] CVE-2018-2380: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","content_text":"SAP · Customer Relationship Management (CRM). In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 28.9% (higher than 98.2% of CVEs). CVSS 6.6 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 77.3 of 100.","summary":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:55:36.000Z","tags":["kev","ransomware","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":77.3,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.28934,"percentile":0.98152},"cvss":{"score":6.6,"severity":"MEDIUM","version":"3.1"},"vendor":"SAP","product":"Customer Relationship Management (CRM)","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-6287#kev","url":"https://patchfirst.co/cve/CVE-2020-6287/","title":"[KEV] CVE-2020-6287: SAP NetWeaver Missing Authentication for Critical Function Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 94.7% (higher than 99.86% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 70.0 of 100.","summary":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:23:00.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":70,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.94719,"percentile":0.99857},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-6207#kev","url":"https://patchfirst.co/cve/CVE-2020-6207/","title":"[KEV] CVE-2020-6207: SAP Solution Manager Missing Authentication for Critical Function Vulnerability","content_text":"SAP · Solution Manager. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.8 of 100.","summary":"SAP Solution Manager Missing Authentication for Critical Function Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:22:52.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.98135,"percentile":0.99913},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"Solution Manager","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-3976#kev","url":"https://patchfirst.co/cve/CVE-2016-3976/","title":"[KEV] CVE-2016-3976: SAP NetWeaver Directory Traversal Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 47.3% (higher than 98.8% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.0 of 100.","summary":"SAP NetWeaver Directory Traversal Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T00:46:39.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.47252,"percentile":0.98837},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2010-5326#kev","url":"https://patchfirst.co/cve/CVE-2010-5326/","title":"[KEV] CVE-2010-5326: SAP NetWeaver Remote Code Execution Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 17.8% (higher than 97.2% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Priority 64.4 of 100.","summary":"SAP NetWeaver Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-16T23:26:33.000Z","tags":["kev","T1059","T1190"],"_patchfirst":{"reason":"kev","priority":64.4,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.1777,"percentile":0.97161},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1059","T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2016-9563#kev","url":"https://patchfirst.co/cve/CVE-2016-9563/","title":"[KEV] CVE-2016-9563: SAP NetWeaver XML External Entity (XXE) Vulnerability","content_text":"SAP · NetWeaver. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 24.2% (higher than 97.9% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 62.1 of 100.","summary":"SAP NetWeaver XML External Entity (XXE) Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T00:56:14.000Z","tags":["kev","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":62.1,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.24226,"percentile":0.97855},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"SAP","product":"NetWeaver","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-33690","url":"https://patchfirst.co/cve/CVE-2021-33690/","title":"CVE-2021-33690: Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure…","content_text":"SAP SE · SAP NetWeaver Development Infrastructure (Component Build Service). Not in CISA KEV. EPSS 69.1% (higher than 99.35% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 67.5 of 100.","summary":"Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure…","date_published":"2021-09-15T00:00:00.000Z","date_modified":"2024-08-03T23:58:22.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67.5,"kev":null,"epss":{"score":0.69075,"percentile":0.99352},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.0"},"vendor":"SAP SE","product":"SAP NetWeaver Development Infrastructure (Component Build Service)","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2021-21479","url":"https://patchfirst.co/cve/CVE-2021-21479/","title":"CVE-2021-21479: In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the…","content_text":"SAP SE · SCIMono. Not in CISA KEV. EPSS 10.1% (higher than 95.6% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 64.8 of 100.","summary":"In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the…","date_published":"2021-02-09T00:00:00.000Z","date_modified":"2024-08-03T18:16:22.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":64.8,"kev":null,"epss":{"score":0.10116,"percentile":0.95637},"cvss":{"score":8.1,"severity":"HIGH","version":"3.0"},"vendor":"SAP SE","product":"SCIMono","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-26836","url":"https://patchfirst.co/cve/CVE-2020-26836/","title":"CVE-2020-26836: SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading…","content_text":"SAP SE · SAP Solution Manager (Trace Analysis). Not in CISA KEV. EPSS 2.2% (higher than 82.5% of CVEs). CVSS 3.4 LOW. Public exploit code exists. Priority 63.9 of 100.","summary":"SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading…","date_published":"2020-12-09T00:00:00.000Z","date_modified":"2024-08-04T16:03:22.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":63.9,"kev":null,"epss":{"score":0.022,"percentile":0.82493},"cvss":{"score":3.4,"severity":"LOW","version":"3.0"},"vendor":"SAP SE","product":"SAP Solution Manager (Trace Analysis)","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-6308","url":"https://patchfirst.co/cve/CVE-2020-6308/","title":"CVE-2020-6308: SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated…","content_text":"SAP SE · SAP BusinessObjects Business Intelligence Platform (Web Services). Not in CISA KEV. EPSS 61.7% (higher than 99.17% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 63.5 of 100.","summary":"SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated…","date_published":"2020-10-20T00:00:00.000Z","date_modified":"2024-08-04T08:55:22.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":63.5,"kev":null,"epss":{"score":0.61736,"percentile":0.9917},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.0"},"vendor":"SAP SE","product":"SAP BusinessObjects Business Intelligence Platform (Web Services)","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-6286","url":"https://patchfirst.co/cve/CVE-2020-6286/","title":"CVE-2020-6286: The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM…","content_text":"SAP SE · SAP NetWeaver AS JAVA (LM Configuration Wizard). Not in CISA KEV. EPSS 23.7% (higher than 97.8% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 69.0 of 100.","summary":"The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM…","date_published":"2020-07-14T00:00:00.000Z","date_modified":"2024-08-04T08:55:22.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":69,"kev":null,"epss":{"score":0.23679,"percentile":0.97814},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.0"},"vendor":"SAP SE","product":"SAP NetWeaver AS JAVA (LM Configuration Wizard)","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-2392","url":"https://patchfirst.co/cve/CVE-2018-2392/","title":"CVE-2018-2392: Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML…","content_text":"SAP SE · SAP Internet Graphics Server. Not in CISA KEV. EPSS 41.1% (higher than 98.7% of CVEs). Public exploit code exists. Priority 59.7 of 100.","summary":"Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML…","date_published":"2018-02-14T00:00:00.000Z","date_modified":"2024-08-05T04:14:39.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":59.7,"kev":null,"epss":{"score":0.41051,"percentile":0.9866},"cvss":null,"vendor":"SAP SE","product":"SAP Internet Graphics Server","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}