Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

SAP: actively exploited vulnerabilities

14 vulnerabilities in SAP products are listed in CISA’s catalog of actively exploited vulnerabilities, 3 of them used by ransomware. Latest addition on May 15, 2025: CVE-2025-42999 (NetWeaver).

Affected products

  • NetWeaver10
  • Commerce Cloud1
  • Customer Relationship Management (CRM)1
  • Multiple Products1
  • Solution Manager1

Our analyses

CERT-FR alerts and notices

Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.

  1. CERTFR-2025-ALE-005

    Vulnérabilité dans SAP NetWeaver (28 avril 2025)

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2025 3 vulnerabilities

  1. CVE-2025-42999Used by ransomware

    SAP NetWeaver Deserialization Vulnerability

    NVD entryCISA catalog

  2. CVE-2025-31324Used by ransomware

    SAP NetWeaver Unrestricted File Upload Vulnerability

    NVD entryCISA catalog

  3. CVE-2017-12637

    SAP NetWeaver Directory Traversal Vulnerability

    NVD entryCISA catalog

2024 1 vulnerability

  1. CVE-2019-0344

    SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

    NVD entryCISA catalog

2022 4 vulnerabilities

  1. CVE-2022-22536

    SAP Multiple Products HTTP Request Smuggling Vulnerability

    NVD entryCISA catalog

  2. CVE-2021-38163

    SAP NetWeaver Unrestricted File Upload Vulnerability

    NVD entryCISA catalog

  3. CVE-2016-2388

    SAP NetWeaver Information Disclosure Vulnerability

    NVD entryCISA catalog

  4. CVE-2016-2386

    SAP NetWeaver SQL Injection Vulnerability

    NVD entryCISA catalog

2021 6 vulnerabilities

  1. CVE-2020-6287

    SAP NetWeaver Missing Authentication for Critical Function Vulnerability

    NVD entryCISA catalog

  2. CVE-2020-6207

    SAP Solution Manager Missing Authentication for Critical Function Vulnerability

    NVD entryCISA catalog

  3. CVE-2018-2380Used by ransomware

    SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

    NVD entryCISA catalog

  4. CVE-2016-9563

    SAP NetWeaver XML External Entity (XXE) Vulnerability

    NVD entryCISA catalog

  5. CVE-2016-3976

    SAP NetWeaver Directory Traversal Vulnerability

    NVD entryCISA catalog

  6. CVE-2010-5326

    SAP NetWeaver Remote Code Execution Vulnerability

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.