Vulnerabilities in SAP_SE

571 results
Vexday analysis

Com 555 CVEs catalogadas e 53 de severidade crítica, o portfólio de vulnerabilidades da SAP SE apresenta uma superfície de ataque considerável, com 45 novas entradas registradas nos últimos 90 dias, indicando ritmo contínuo de descobertas. A taxa de exploração ativa está abaixo da média geral do catálogo, com 2 entradas confirmadas no CISA KEV, mas o EPSS de 0,9936 associado ao CVE-2025-31324 — a vulnerabilidade mais perigosa em exploração ativa no momento — sinaliza probabilidade extremamente elevada de exploração em ambiente real e merece atenção prioritária imediata. A falha mais frequente é CWE-862 (ausência de verificação de autorização), padrão que tende a favorecer escalada de privilégios e acesso não autorizado a recursos protegidos. A existência de 4 CVEs com PoC pública reforça a necessidade de acompanhamento rigoroso do ciclo de patching, especialmente em implantações voltadas a sistemas críticos de negócio.

CVE-2025-31324CRITICALMissing Authorization check in SAP NetWeaver (Visual Composer development server)EPSS 99.5%KEVCVE-2024-41730CRITICALMissing Authentication check in SAP BusinessObjects Business Intelligence PlatformEPSS 75.9%CVE-2025-42999CRITICALInsecure Deserialization in SAP NetWeaver (Visual Composer development server)EPSS 11.3%KEVCVE-2025-42928CRITICALDeserialization Vulnerability in SAP jConnect - SDK for ASEEPSS 9.3%CVE-2025-42880CRITICALCode Injection vulnerability in SAP Solution ManagerEPSS 4.4%CVE-2024-47586MEDIUMNULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 3.6%CVE-2025-42944CRITICALInsecure Deserialization vulnerability in SAP Netweaver (RMI-P4)EPSS 2.9%CVE-2024-22127CRITICALCode Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)EPSS 1.6%CVE-2025-42957CRITICALCode Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)EPSS 1.6%CVE-2026-40135MEDIUMOS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformEPSS 1.4%CVE-2023-50422CRITICALEscalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)EPSS 1.4%CVE-2023-50424CRITICALEscalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)EPSS 1.1%CVE-2023-50423CRITICALEscalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)EPSS 1.1%CVE-2023-49583CRITICALEscalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)EPSS 1.1%CVE-2024-22131CRITICALCode Injection vulnerability in SAP ABA (Application Basis)EPSS 1.1%CVE-2023-37483CRITICALImproper Access Control Vulnerabilities in SAP PowerDesignerEPSS 1.0%CVE-2023-33989HIGHDirectory Traversal vulnerability in SAP NetWeaver (BI CONT ADD ON)EPSS 1.0%CVE-2025-42946MEDIUMDirectory Traversal vulnerability in SAP S/4HANA (Bank Communication Management)EPSS 0.9%CVE-2024-47578CRITICALMultiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)EPSS 0.9%CVE-2026-0507HIGHOS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDKEPSS 0.9%