SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

CVE-2026-66779

Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the...

CVE-2026-58241

SAP NetWeaver and ABAP Platform Change and Transport System - Customer Transport Integration Wizard allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and...

CVE-2026-58235

SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected...

CVE-2026-58236

SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to th...

CVE-2026-34265

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the...

EUVD-2026-55891

Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the...

CVE-2026-66779

CVE-2026-66779 describes a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver Application Server ABAP. An authenticated attacker could craft a malicious link that, when opened by a victim, is reflected in the DOM on page render, enabling execution of malicious content in the victim’s b...

EUVD-2026-55873

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

CVE-2026-58243

The CVE-2026-58243 entry concerns SAP ABAP Development Tools failing to perform necessary authorization checks for certain functionality, enabling a low-privilege attacker to perform unauthorized database operations on SAP NetWeaver AS ABAP. The issue can lead to reading and modifying sensitive d...

EUVD-2026-55872

SAP NetWeaver and ABAP Platform Change and Transport System - Customer Transport Integration Wizard allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and...

CVE-2026-58241

Technical details about CVE-2026-58241 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-58236

The CVE-2026-58236 entry concerns SAP NetWeaver Application Server ABAP and ABAP Platform, where an attacker with high privileges can bypass a missing security control on an internal code path and trigger OS command execution. The impact description indicates OS-level command execution that could...

EUVD-2026-55868

SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to th...

EUVD-2026-55867

SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected...

CVE-2026-58235

CVE-2026-58235 affects SAP NetWeaver Application Server Java (Adobe Document Service). The issue arises from use of outdated third-party cryptographic and data transfer libraries that have known weaknesses and were addressed in later versions. A low-privileged authenticated attacker could potenti...

CVE-2026-34265 Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the...

EUVD-2026-55859

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the...

CVE-2026-34265

CVE-2026-34265 affects SAP NetWeaver Application Server ABAP (and ABAP Platform) due to memory corruption from logical errors in DIAG protocol parsing. The issue is exploitable by an unauthenticated attacker over the network and can lead to disclosure of sensitive information or system crash, wit...

PT-2026-70019

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description An unauthenticated attacker can exploit logical errors in the parsing of the DIAG protocol, which is a proprietary SAP protocol used for communication between th...