Vendor scorecard
CISA lists 14 SAP vulnerabilities as exploited in the wild, 0 of them added in the last 12 months (down from 3 in the 12 months before). 3 (21%) are known to be used in ransomware campaigns. For entries added in the last two years, the median time from CVE publication to the KEV listing was 5 days. Most affected: NetWeaver (10), Commerce Cloud (1), Multiple Products (1).
| Product | KEV entries |
|---|---|
| NetWeaver | 10 |
| Commerce Cloud | 1 |
| Multiple Products | 1 |
| Customer Relationship Management (CRM) | 1 |
| Solution Manager | 1 |
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2025-42999 | SAP NetWeaver Deserialization VulnerabilityRANSOMWARENetWeaver | |
| CVE-2025-31324 | SAP NetWeaver Unrestricted File Upload VulnerabilityRANSOMWARENetWeaver | |
| CVE-2017-12637 | SAP NetWeaver Directory Traversal VulnerabilityNetWeaver | |
| CVE-2019-0344 | SAP Commerce Cloud Deserialization of Untrusted Data VulnerabilityCommerce Cloud | |
| CVE-2022-22536 | SAP Multiple Products HTTP Request Smuggling VulnerabilityMultiple Products | |
| CVE-2021-38163 | SAP NetWeaver Unrestricted File Upload VulnerabilityNetWeaver | |
| CVE-2016-2388 | SAP NetWeaver Information Disclosure VulnerabilityNetWeaver | |
| CVE-2016-2386 | SAP NetWeaver SQL Injection VulnerabilityNetWeaver | |
| CVE-2020-6287 | SAP NetWeaver Missing Authentication for Critical Function VulnerabilityNetWeaver | |
| CVE-2020-6207 | SAP Solution Manager Missing Authentication for Critical Function VulnerabilitySolution Manager | |
| CVE-2018-2380 | SAP Customer Relationship Management (CRM) Path Traversal VulnerabilityRANSOMWARECustomer Relationship Management (CRM) | |
| CVE-2016-9563 | SAP NetWeaver XML External Entity (XXE) VulnerabilityNetWeaver | |
| CVE-2016-3976 | SAP NetWeaver Directory Traversal VulnerabilityNetWeaver | |
| CVE-2010-5326 | SAP NetWeaver Remote Code Execution VulnerabilityNetWeaver |
Get an email when CISA adds the next SAP CVE.
How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (3 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.
We assess supplier security for NIS2 and DORA, from exploited-CVE history and patch response to contract clauses and evidence packs.
Get in touch →