PT-2026-111142

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal affected versions not specified Description An unauthenticated attacker can inject malicious scripts into a URL parameter. These scripts are reflected in the server response and executed in the browser of a user...

PT-2026-111131

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description Applications based on SAP GUI for HTML do not sufficiently sanitize user-supplied content in certain functionality. This allows an authenticated attacker to send...

PT-2026-111128

Name of the Vulnerable Software and Affected Versions SAP NetWeaver affected versions not specified SAP Web Dispatcher affected versions not specified Description An internal protocol component fails to properly validate certain fields in specially crafted requests. An unauthenticated attacker ca...

PT-2026-111137

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Visual Composer affected versions not specified Description Insufficient authorization checks in certain portal functionality allow an attacker with low privileges to invoke internal operations on a preconfigured remote system...

SAP NetWeaver Metadata Uploader RCE (CVE-2025-31324)

Exploits CVE-2025-31324 unauthenticated file upload via SAP NetWeaver Visual Composer Metadata Uploader to deploy a JSP webshell and execute a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer Metadata Uploader RCE CVE-2025-31324.""" import re import...

SAP Message Server Code Execution

The vulnerability of the SAP Message Server, a software integration platform of SAP NetWeaver, is related to the use of single-factor authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

SAP NetWeaver Extended Passport Remote Code Execution

SAP NetWeaver AS ABAP and Java and SAP Web Dispatcher contain a stack based buffer overflow vulnerability in Extended Passport processing. Missing bounds validation of attacker-supplied metadata allows an unauthenticated remote attacker to corrupt stack memory and execute arbitrary code through...

SAP NetWeaver Application Server ABAP Auth Bypass

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of protected information from a remote location...

SAP NetWeaver SQL Injection Unauthorized Access

The vulnerability of the SAP NetWeaver software integration platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

SAP NetWeaver Application Server ABAP Data Compromise

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

RFC modules in developing Information Disclosure

The vulnerability of RFC software modules for developing and executing applications in the ABAP SAP NetWeaver Application Server ABAP environment is related to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to disclose the protected information...

SAP NetWeaver Application Server ABAP Auth Bypass

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms is related to the absence of authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

SAP NetWeaver AS ABAP Missing Authorization Check (3772838)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a missing authorization check vulnerability as referenced in SAP Security Note 3772838: - Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker...

SAP NetWeaver Memory Corruption (3757002)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3757002: - SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that...

SAP NetWeaver AS Java Denial of Service (3736494)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a denial of service vulnerability as referenced in SAP Security Note 3736494: - SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested...

SAP NetWeaver Memory Corruption (3747649)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3747649: - A memory safety vulnerability exists in the Extended Passport Protocol EPP processing library. Under specific conditions, an...

SAP NetWeaver Information Disclosure (3750721)

The version of the SAP NetWeaver kernel detected on the remote host is affected by an information disclosure vulnerability as referenced in SAP Security Note 3750721: - SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to...

SAP NetWeaver Missing Authentication (3759472)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a missing authentication vulnerability as referenced in SAP Security Note 3759472: - SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during...

CVE-2026-76963

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CVE-2026-76967

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the craft...