SAP

Records1968All Threatist records

Exploited (KEV)14In CISA KEV

CVSS critical221CVSS 9.0–10.0

CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV

TI-2025-27866 SAP NetWeaver Deserialization Vulnerability CRITICAL 98KEV 2025-05-15 TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability CRITICAL 100KEV 2025-04-29 TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability CRITICAL 90KEV 2025-03-19 TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2024-09-30 TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability CRITICAL 100KEV 2022-08-18 TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records

3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

13 records in Approuter · all components

TI-2026-22067 CVE-2026-27690 · GHSA-8m85-wqg7-c529

HTTP Request Smuggling in SAP Approuter

MEDIUM 48

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00682 Published 2026-07-14 Fixed in 20.10.0 CWE-444

TI-2026-32632 CVE-2026-44745 · GHSA-44p5-3m5g-vfhj

Open Redirect vulnerability in SAP Approuter

LOW 38

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00466 Published 2026-07-14 Fixed in 21.2.0 CWE-601

TI-2026-41933 CVE-2026-58230 · GHSA-vhh6-v828-x62f

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 31

SAP Approuter does not sufficiently validate certain token content under specific configurations.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00314 Published 2026-08-11 Fixed in 23.0.0 CWE-601

TI-2026-47423 CVE-2026-66778 · GHSA-h7cr-m88c-98m3

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 30

SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00358 Published 2026-08-11 No fix listed CWE-644

TI-2026-47408 CVE-2026-66760 · GHSA-x986-f697-6r4v

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 28

SAP Approuter does not correctly validate client certificates in certain callback flows.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00181 Published 2026-08-11 No fix listed CWE-295

TI-2026-47422 CVE-2026-66777 · GHSA-94ww-hmrp-6w4f

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 27

SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.00439 Published 2026-08-11 No fix listed CWE-22

TI-2026-41940 CVE-2026-58238 · GHSA-pmcc-wjfp-vchv

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 27

SAP Approuter does not sufficiently handle certain requests under specific conditions.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00429 Published 2026-08-11 No fix listed CWE-770

TI-2026-47421 CVE-2026-66776 · GHSA-2x68-8jqv-5gp3

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 26

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.002 Published 2026-08-11 No fix listed CWE-347

TI-2026-41939 CVE-2026-58237 · GHSA-pf62-cqrr-jr3r

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 26

WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.00278 Published 2026-08-11 No fix listed CWE-862

TI-2026-47409 CVE-2026-66761 · GHSA-j28w-983h-rg43

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 20

SAP Approuter does not enforce sufficient flow control in certain functionality.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00382 Published 2026-08-11 No fix listed CWE-770

TI-2026-47420 CVE-2026-66775 · GHSA-397p-hh8q-gwmh

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 19

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00165 Published 2026-08-11 No fix listed CWE-352

TI-2026-47419 CVE-2026-66774 · GHSA-82g4-h784-m68h

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 18

SAP Approuter does not consistently handle certain error conditions.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00353 Published 2026-08-11 No fix listed CWE-754

TI-2026-41941 CVE-2026-58239 · GHSA-w69g-xj7m-rmrv

Multiple vulnerabilities in SAP Business AI Platform (Approuter)

LOW 18

SAP Approuter does not sufficiently validate tenant context in inbound requests.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00346 Published 2026-08-11 No fix listed CWE-807

Open these records in search →

Critical	221
High	534
Medium	1145
Low	68
No CVSS	0