NA
Product
Netweaver Application Server Abap
On CISA KEVExploited in the wild
86
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 18Medium 54Low 3
Watch
Add Netweaver Application Server Abap to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44235 | 6.7 | Dec 14 | Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high… Affected: 700; 701; 702; 710; 711; 730; +9 more |
| CVE-2021-27611 | 6.7 | May 11 | SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP report when the attacker has access to… Affected: 700; 701; 702; 730; 731 |
| CVE-2026-40135 | 6.5 | May 12 | OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform Affected: 700; 701; 702; 731; 740; 750; +9 more |
| CVE-2024-33001 | 6.5 | Jun 11 | SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service Affected: 740; 2008_1_710; st-pi_2008_1_700 |
| CVE-2023-37492 | 6.5 | Aug 8 | SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752,… Affected: 700; 701; 702; 731; 740; 750; +9 more |
| CVE-2023-28763 | 6.5 | Apr 11 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a… Affected: 740; 750; 751; 752; 753; 754; +4 more |
| CVE-2023-27270 | 6.5 | Mar 14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a… Affected: 700; 701; 702; 731; 740; 750; +8 more |
| CVE-2023-25618 | 6.5 | Mar 14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in an… Affected: 700; 701; 702; 731; 740; 750; +8 more |
| CVE-2021-33678 | 6.5 | Jul 14 | A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows… Affected: 75a; 75b; 75c; 75d; 75e; 75f; +11 more |
| CVE-2021-27603 | 6.5 | Apr 13 | An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time Affected: 731; 740; 750 |
| CVE-2020-6270 | 6.5 | Jun 10 | SAP NetWeaver AS ABAP (Banking Services), versions - 710, 711, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not perform necessary authorization checks for an authenticated… Affected: 75a; 75b; 75c; 75d; 75e; 710; +5 more |
| CVE-2026-24316 | 6.4 | Mar 10 | Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP Affected: 740; 750; 752; 753; 754; 755; +5 more |
| CVE-2026-24309 | 6.4 | Mar 10 | Missing Authorization check in SAP NetWeaver Application Server for ABAP Affected: 700; 701; 702; 731; 740; 750; +9 more |
| CVE-2021-21473 | 6.3 | Jun 9 | SAP NetWeaver AS ABAP and ABAP Platform, versions - 700, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, contains function module SRM_RFC_SUBMIT_REPORT which fails to… Affected: 700; 702; 710; 711; 730; 731; +7 more |
| CVE-2026-27682 | 6.1 | May 12 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) Affected: 700; 701; 702; 731; 740; 750; +10 more |
| CVE-2026-34257 | 6.1 | Apr 14 | Open Redirect vulnerability in SAP NetWeaver Application Server ABAP Affected: 700; 701; 702; 731; 740; 750; +8 more |
| CVE-2023-27499 | 6.1 | Apr 11 | SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled… Affected: 7.22; 7.53; 7.54; 7.77; 7.81; 7.85; +4 more |
| CVE-2023-25614 | 6.1 | Feb 14 | SAP NetWeaver AS ABAP (BSP Framework) application - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allow an unauthenticated attacker to inject the code… Affected: 700; 701; 702; 731; 740; 750; +7 more |
| CVE-2023-24522 | 6.1 | Feb 14 | Due to insufficient input sanitization, SAP NetWeaver AS ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, allows an unauthenticated user to alter the current… Affected: 700; 701; 702; 731; 740 |
| CVE-2023-23860 | 6.1 | Feb 14 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a link, which when… Affected: 740; 750; 751; 752; 753; 754; +5 more |
| CVE-2023-23859 | 6.1 | Feb 14 | SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated attacker to craft a malicious link, which… Affected: 740; 750; 751; 752; 753; 754; +5 more |
| CVE-2023-23858 | 6.1 | Feb 14 | Due to insufficient input validation, SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, allows an unauthenticated… Affected: 740; 750; 751; 752; 753; 754; +3 more |
| CVE-2023-23853 | 6.1 | Feb 14 | An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, can… Affected: 700; 702; 731; 740; 750; 751; +8 more |
| CVE-2023-0013 | 6.1 | Jan 10 | The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not… Affected: 702; 731; 740; 750; 751; 752; +5 more |
| CVE-2022-39799 | 6.1 | Sep 13 | An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack Affected: 7.54; 7.81; 7.85; 7.89; kernel_7.77 |
| CVE-2021-21490 | 6.1 | Jun 9 | SAP NetWeaver AS for ABAP (Web Survey), versions - 700, 702, 710, 711, 730, 731, 750, 750, 752, 75A, 75F, does not sufficiently encode input and output parameters which results in… Affected: 75a; 75f; 700; 702; 710; 711; +4 more |
| CVE-2020-26835 | 6.1 | Dec 9 | SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in the URL which could be… Affected: 740; 750; 751; 752; 753; 754 |
| CVE-2019-0321 | 6.1 | Jul 10 | ABAP Server and ABAP Platform (SAP Basis), versions, 7.31, 7.4, 7.5, do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability Affected: 7.31 |
| CVE-2024-41732 | 5.4 | Aug 13 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls Affected: 755; 756; 757; 758; sap_basis_700; sap_basis_701; +4 more |
| CVE-2024-21738 | 5.4 | Jan 9 | SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker with… Affected: 79; 700; 701; 702; 731; 740; +10 more |
| CVE-2023-40624 | 5.4 | Sep 12 | SAP NetWeaver AS ABAP (applications based on Unified Rendering) - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, SAP_BASIS 702, SAP_BASIS 731, allows an… Affected: 702; 731; 754; 755; 756; 757; +1 more |
| CVE-2023-23854 | 5.4 | Feb 14 | SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated… Affected: 700; 701; 702; 731; 740; 750; +2 more |
| CVE-2022-35294 | 5.4 | Sep 13 | An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other… Affected: 7.22ext; 7.49; 7.53; 7.54; 7.77; 7.81; +5 more |
| CVE-2022-29610 | 5.4 | May 11 | SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) data, which could result in Stored Cross-Site Scripting (XSS)… Affected: 753; 754; 755; 756 |
| CVE-2022-26102 | 5.4 | Mar 10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start… Affected: 700; 701; 702; 731 |
| CVE-2021-33665 | 5.4 | Jun 9 | SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81,7.84, does not… Affected: kernel_7.49; kernel_7.53; kernel_7.77; kernel_7.81; kernel_7.84; krnl64nuc_7.49; +2 more |
| CVE-2021-33664 | 5.4 | Jun 9 | SAP NetWeaver Application Server ABAP (Applications based on Web Dynpro ABAP), versions - SAP_UI - 750,752,753,754,755, SAP_BASIS - 702, 731 does not sufficiently encode… Affected: 31; 702; 750; 752; 753; 754; +1 more |
| CVE-2024-24740 | 5.3 | Feb 13 | SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain… Affected: kernel_7.53; kernel_7.54; kernel_7.77; kernel_7.85; kernel_7.89; kernel_7.93; +2 more |
| CVE-2023-41366 | 5.3 | Nov 14 | Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.91, KERNEL 7.92,… Affected: kernel_7.22; kernel_7.53; kernel_7.54; kernel_7.77; kernel_7.85; kernel_7.89; +9 more |
| CVE-2021-40495 | 5.3 | Oct 12 | There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755 Affected: 740; 750; 751; 752; 753; 754; +1 more |
| CVE-2021-33684 | 5.3 | Jul 14 | SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49,… Affected: 7.21; 7.21ext; 7.22; 7.22ext; 7.49; 7.53; +7 more |
| CVE-2021-33663 | 5.3 | Jun 9 | SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, KRNL32UC - 7.22,7.22EXT, KRNL64NUC - 7.22,7.22EXT,7.49, KRNL64UC - 8.04,7.22,7.22EXT,7.49,7.53,7.73, KERNEL -… Affected: kernel_7.22; kernel_7.49; kernel_7.53; kernel_7.73; kernel_7.77; kernel_7.81; +17 more |
| CVE-2026-27688 | 5.0 | Mar 10 | Missing Authorization check in SAP NetWeaver Application Server for ABAP Affected: 700; 701; 702; 730; 731; 740; +10 more |
| CVE-2022-41212 | 4.9 | Nov 8 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote enabled function to… Affected: 700; 731; 740; 750; 789; 804 |
| CVE-2021-40504 | 4.9 | Nov 10 | A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756,… Affected: 700; 701; 702; 710; 711; 730; +9 more |
| CVE-2022-41215 | 4.7 | Nov 8 | SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation Affected: 700; 731; 740; 750; 789 |
| CVE-2026-27680 | 4.3 | May 14 | CSS Injection vulnerability in SAP NetWeaver Application Server ABAP Affected: 758; 816 |
| CVE-2026-24310 | 4.3 | Mar 10 | Missing Authorization check in SAP NetWeaver Application Server for ABAP Affected: 702; 731; 740; 750; 751; 752; +7 more |
| CVE-2024-41734 | 4.3 | Aug 13 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to… Affected: sap_basis_700; sap_basis_701; sap_basis_702; sap_basis_731; sap_basis_740; sap_basis_750; +9 more |
| CVE-2021-42067 | 4.3 | Jan 14 | In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker authenticated as a regular user can use… Affected: 701; 702; 711; 730; 731; 740; +8 more |