Login Request a demo
NE
Product
NetWeaver
by SAP · last CVE Feb 10, 2026
On CISA KEVExploited in the wildRansomware-linked
109
CVEs
10
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities109In the news0Timeline
Severity mix
Critical 11High 21Medium 27Low 2
Severity
All severities109Critical11High21Medium27Low2
Exploitation
On CISA KEV10Exploited in the wild10
Watch

Add NetWeaver to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-6287
In wildKEV
10.0
95%
Jul 14
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
Affected: All versions, or not specified
CVE-2010-5326
In wildKEV
10.0
18%
May 13
SAP NetWeaver Remote Code Execution Vulnerability
Affected: All versions, or not specified
CVE-2025-31324
RansomwareIn wildKEV
9.8
99%
Apr 24
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
Affected: 7.50
CVE-2016-2386
In wildKEV
9.8
72%
Feb 16
SAP NetWeaver SQL Injection Vulnerability
Affected: All versions, or not specified
CVE-2025-42999
RansomwareIn wildKEV
9.1
13%
May 13
Insecure Deserialization in SAP NetWeaver (Visual Composer development server)
Affected: 7.5
CVE-2011-1517
9.8
4%
Feb 5
SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function
Affected: 7.0
CVE-2013-1592
9.8
24%
Jan 23
A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports…
Affected: 7.01; 7.02; 7.30; 2004s
CVE-2015-7241
9.8
13%
Sep 6
XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01
Affected: through 7.0
CVE-2016-10311
9.8
2%
Apr 10
Stack-based buffer overflow in SAP NetWeaver 7.0 through 7.5 allows remote attackers to cause a denial of service () by sending a crafted packet to the SAPSTARTSRV port, aka SAP…
Affected: 7.0; 7.0; 7.0; 7.0; 7.3; 7.3; +2 more
CVE-2020-6203
9.1
2%
Mar 10
SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information…
Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2016-7435
9.1
3%
Oct 5
The (1) SCTC_REFRESH_EXPORT_TAB_COMP, (2) SCTC_REFRESH_CHECK_ENV, and (3) SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote…
Affected: 7.40
Showing 11