NA
Product
Netweaver Application Server Java
On CISA KEVExploited in the wild
69
CVEs
7
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 11High 20Medium 37Low 1
Watch
Add Netweaver Application Server Java to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-6282 | 5.8 | Jul 14 | SAP NetWeaver AS JAVA (IIOP service) (SERVERCORE), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, and SAP NetWeaver AS JAVA (IIOP service) (CORE-TOOLS), versions 7.10, 7.11,… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2020-6190 | 5.8 | Feb 12 | Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server… Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2021-27601 | 5.4 | Apr 13 | SAP NetWeaver AS Java (Applications based on HTMLB for Java) allows a basic-level authorized attacker to store a malicious file on the server Affected: 7.10; 7.11; 7.30; 7.31; 7.40; 7.50 |
| CVE-2019-0275 | 5.4 | Mar 12 | SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS), versions 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40 and 7.50, does not sufficiently encode… Affected: 7.10 through 7.11; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2025-42926 | 5.3 | Sep 9 | SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully… Affected: 7.50 |
| CVE-2024-28164 | 5.3 | Jun 11 | SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low… Affected: gp-core_7.5 |
| CVE-2023-42480 | 5.3 | Nov 14 | The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids. This will have an… Affected: 7.50 |
| CVE-2023-24526 | 5.3 | Mar 14 | SAP NetWeaver Application Server Java for Classload Service - version 7.50, does not perform any authentication checks for functionalities that require user identity, resulting in… Affected: 7.50 |
| CVE-2022-26103 | 5.3 | Mar 10 | Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to information gathering for… Affected: 7.50 |
| CVE-2021-27598 | 5.3 | Apr 13 | SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet), versions - 7.31, 7.40, 7.50, allows an attacker to read some statistical data like product version, traffic, timestamp… Affected: 7.31; 7.40; 7.50 |
| CVE-2020-6286 | 5.3 | Jul 14 | The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an… Affected: 7.30; 7.31; 7.40; 7.50 |
| CVE-2019-0318 | 5.3 | Jul 10 | Under certain conditions SAP NetWeaver Application Server for Java (Startup Framework), versions 7.21, 7.22, 7.45, 7.49, and 7.53, allows an attacker to access information which… Affected: 7.21; 7.22; 7.45; 7.49; 7.53 |
| CVE-2016-3973 | 5.3 | Apr 7 | The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by… Affected: 7.10 through 7.50 |
| CVE-2021-33687 | 4.9 | Jul 14 | SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP requests, an attacker can use this in… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2020-26816 | 4.5 | Dec 9 | SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetWeaver AS Java Key Storage service… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2021-33689 | 4.3 | Jul 14 | When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version - 7.50, no security audit log is… Affected: 7.50 |
| CVE-2021-21492 | 4.3 | Apr 13 | SAP NetWeaver Application Server Java(HTTP Service), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate logon group in URLs, resulting in a… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more |
| CVE-2019-0391 | 4.3 | Nov 13 | Under certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) allows an attacker to access information which would otherwise be restricted Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50 |
| CVE-2026-23686 | 3.4 | Feb 10 | Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the… Affected: 7.50 |