Netweaver Application Server Java vulnerabilities | LiveThreat CVE Feed

Product

Netweaver Application Server Java

by Sap · last CVE Apr 14, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities69 In the news0 Timeline

Severity mix

Critical 11High 20Medium 37Low 1

Severity

All severities69 Critical11 High20 Medium37 Low1

Exploitation

On CISA KEV7 Exploited in the wild7

Watch

Add Netweaver Application Server Java to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2017-12637 In wildKEV	7.5	95%	Aug 7	SAP NetWeaver Directory Traversal Vulnerability Affected: 7.50
CVE-2016-3976 In wildKEV	7.5	47%	Apr 7	SAP NetWeaver Directory Traversal Vulnerability Affected: 7.10 through 7.50
CVE-2019-0389	8.8	1%	Nov 13	An administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in versions 7.1, 7.2, 7.3, 7.31, 7.4, 7.5), may change privileges for all or some functions… Affected: 7.1; 7.2; 7.3; 7.4; 7.5; 7.31
CVE-2017-8913	8.8	1%	May 23	The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a crafted XML document in… Affected: 7.50
CVE-2017-7717	8.8	2%	Apr 14	SQL injection vulnerability in the getUserUddiElements method in the ES UDDI component in SAP NetWeaver AS Java 7.4 allows remote authenticated users to execute arbitrary SQL… Affected: 7.40
CVE-2015-8840	8.8	1%	Apr 8	The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain… Affected: All versions, or not specified
CVE-2024-34688	7.5	1%	Jun 11	Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users… Affected: mmr_server_7.5
CVE-2024-24743	7.5	1%	Feb 13	SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which… Affected: 7.50
CVE-2023-40308	7.5	1%	Sep 12	SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes… Affected: kernel_7.22; kernel_7.53; kernel_7.54; kernel_7.77; kernel_7.85; kernel_7.89; +10 more
CVE-2022-22533	7.5	2%	Feb 9	Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an… Affected: 7.22; 7.49; 7.53; krnl64nuc_7.22; krnl64nuc_7.22ext; krnl64nuc_7.49; +3 more
CVE-2021-33670	7.5	3%	Jul 14	SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send multiple HTTP requests with different… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2020-6309	7.5	2%	Aug 12	SAP NetWeaver AS JAVA, versions - (ENGINEAPI 7.10; WSRM 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; J2EE-FRMW 7.10, 7.11), does not perform any authentication checks for a web… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2017-14581	7.5	2%	Sep 19	The Host Control web service in SAP NetWeaver AS JAVA 7.0 through 7.5 allows remote attackers to cause a denial of service (service crash) via a crafted request, aka SAP Security… Affected: 7.00 through 7.50
CVE-2016-9562	7.5	4%	Nov 23	SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the… Affected: 7.40
CVE-2018-2503	7.4	1%	Dec 11	By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected Affected: 7.11; 7.20; 7.30; 7.31; 7.40; 7.50
CVE-2020-26820	7.2	4%	Nov 10	SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose… Affected: 7.20; 7.30; 7.31; 7.40; 7.50
CVE-2020-6202	7.2	1%	Mar 10	SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50
CVE-2019-0355	7.2	2%	Sep 10	SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and SAP-JEECOR (before versions 6.40, 7.0, 7.01), allows an… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50
CVE-2019-0327	7.2	2%	Jul 10	SAP NetWeaver for Java Application Server - Web Container, (engineapi, versions 7.1, 7.2, 7.3, 7.31, 7.4 and 7.5), (servercode, versions 7.2, 7.3, 7.31, 7.4, 7.5), allows an… Affected: 7.10; 7.20; 7.30; 7.31; 7.40; 7.50
CVE-2018-2492	7.1	1%	Dec 11	SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source Affected: 7.20; 7.30; 7.31; 7.40; 7.50