SAP NetWeaver
23 notes since January 2023.
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
| Patch Day | Note | Title | Priority (derived from CVSS, not SAP’s priority) | CVSS |
|---|---|---|---|---|
| September 2026 | 3759472 | Missing Authentication check in SAP NetWeaver (Message Server) | Critical | 9.8 |
| September 2026 | 3781729 | Improper Access Control in SAP NetWeaver (SAP GUI for Java) | Critical | 9.0 |
| March 2026 | 3697355 | SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification) | Medium | 6.4 |
| February 2026 | 3687285 | Insecure Deserialization vulnerability in SAP NetWeaver (JMS service) | Medium | 4.4 |
| December 2025 | 3640185 | Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius) | High | 7.9 |
| September 2025 | 3670067 | Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4) | Critical | 10.0 |
| September 2025 | 3627373 | Missing Authentication check in SAP NetWeaver | Critical | 9.1 |
| September 2025 | 3627644 | Missing Authorization check in SAP NetWeaver (Service Data Download) | Medium | 5.0 |
| July 2025 | 3610892 | Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service) | Critical | 9.1 |
| July 2025 | 3621037 | Missing Authorization check in SAP NetWeaver (RFC enabled function module) | Medium | 5.0 |
| June 2025 | 3590887 | Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation) | Medium | 5.8 |
| May 2025 | 3604119 | Insecure Deserialization in SAP NetWeaver (Visual Composer development server) Known exploited | Critical | 9.1 |
| April 2025 | 3594142 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) Known exploited | Critical | 10.0 |
| April 2025 | 3577131 | Authorization Bypass vulnerability in SAP NetWeaver | Medium | 4.3 |
| March 2025 | 3563927 | Missing Authorization check in SAP NetWeaver (ABAP Class Builder) | High | 8.8 |
| April 2024 | 3425188 | Server-Side Request Forgery in SAP NetWeaver | Medium | 5.3 |
| March 2024 | 3428847 | Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal) | Medium | 5.3 |
| January 2024 | 3392626 | Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager | Medium | 4.1 |
| September 2023 | 3348142 | Missing Authentication check in SAP NetWeaver (Guided Procedures) | Medium | 5.3 |
| July 2023 | 3331376 | Directory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON) | High | 8.7 |
| June 2023 | 3318657 | Cross-Site Scripting (XSS) vulnerability in NetWeaver (Design Time Repository) | Medium | 6.4 |
| June 2023 | 3325642 | Denial of Service in SAP NetWeaver | Low | 2.7 |
| March 2023 | 3274920 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver | Medium | 6.1 |