SAP NetWeaver AS Java
37 notes since January 2023.
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
| Patch Day | Note | Title | Priority (derived from CVSS, not SAP’s priority) | CVSS |
|---|---|---|---|---|
| August 2026 | 3758318 | Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services) | Medium | 6.3 |
| July 2026 | 3748227 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard) | High | 8.2 |
| June 2026 | 3727078 | Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) | Critical | 9.0 |
| June 2026 | 3723655 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet) | Medium | 6.1 |
| April 2026 | 3719397 | Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) | Medium | 6.1 |
| February 2026 | 3673213 | CRLF Injection vulnerability in SAP NetWeaver Application Server Java | Low | 3.4 |
| November 2025 | 3643603 | Information Disclosure vulnerability in SAP NetWeaver Application Server Java | Medium | 5.3 |
| September 2025 | 3643865 | Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service) | Critical | 9.9 |
| September 2025 | 3619465 | Missing Authentication check in SAP NetWeaver Application Server Java | Medium | 5.3 |
| September 2025 | 3640477 | Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service) | Medium | 4.3 |
| September 2025 | 3525295 | Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service) | Low | 3.4 |
| July 2025 | 3621771 | Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer) | Critical | 9.1 |
| July 2025 | 3557179 | Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java | Low | 3.5 |
| March 2025 | 3567246 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java | Medium | 5.4 |
| February 2025 | 3526203 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java | Medium | 5.4 |
| February 2025 | 3550027 | Information Disclosure vulnerability in SAP NetWeaver Application Server Java | Medium | 4.3 |
| January 2025 | 3540108 | Missing Authorization check in SAP NetWeaver Application Server Java | Medium | 6.3 |
| January 2025 | 3514421 | Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application) | Medium | 4.8 |
| December 2024 | 3536965 | Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services) | Critical | 9.1 |
| December 2024 | 3351041 | XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA | Medium | 5.3 |
| November 2024 | 3335394 | Missing Authorization check in SAP NetWeaver AS Java (System Landscape Directory) | Medium | 6.5 |
| November 2024 | 3393899 | Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application) | Medium | 5.3 |
| November 2024 | 3522953 | Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager) | Medium | 4.7 |
| September 2024 | 3477359 | Information disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service) | Medium | 6.0 |
| September 2024 | 3505503 | Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application) | Medium | 4.8 |
| June 2024 | 3460407 | Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) | High | 7.5 |
| June 2024 | 3425571 | Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures) | Medium | 5.3 |
| March 2024 | 3433192 | Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in) | Critical | 9.1 |
| February 2024 | 3426111 | XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures) | High | 8.6 |
| February 2024 | 3417627 | Cross Site Scripting vulnerability in SAP NetWeaver AS Java (User Admin Application) | Medium | 6.1 |
| November 2023 | 3366410 | Information Disclosure in NetWeaver AS Java Logon | Medium | 5.3 |
| October 2023 | 3333426 | Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application) | Medium | 6.5 |
| July 2023 | 3324732 | Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer) | Medium | 5.3 |
| March 2023 | 3252433 | Improper Access Control in SAP NetWeaver AS for Java | Critical | 9.9 |
| March 2023 | 3288096 | Improper Access Control in SAP NetWeaver AS Java (Cache Management Service) | Medium | 5.3 |
| March 2023 | 3288480 | Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service) | Medium | 5.3 |
| January 2023 | 3268093 | Improper access control in SAP NetWeaver AS for Java | Critical | 9.4 |