Vulnerabilities and patches across SAP's enterprise stack — NetWeaver Application Server (Java and ABAP), S/4HANA, Business Technology Platform, AppRouter, and Commerce Cloud — including the monthly SAP Security Patch Day cycle. Combined article + CVE feed for the SAP beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2010-5326/https://0daynews.com/cve/cve-2010-5326/SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2016-2386/https://0daynews.com/cve/cve-2016-2386/SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2016-2388/https://0daynews.com/cve/cve-2016-2388/The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.Tue, 01 Sep 2026 00:00:00 GMTSAPmediumcvehttps://0daynews.com/cve/cve-2016-3976/https://0daynews.com/cve/cve-2016-3976/SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.Tue, 01 Sep 2026 00:00:00 GMTSAPhighcvehttps://0daynews.com/cve/cve-2016-9563/https://0daynews.com/cve/cve-2016-9563/SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.Tue, 01 Sep 2026 00:00:00 GMTSAPmediumcvehttps://0daynews.com/cve/cve-2017-12637/https://0daynews.com/cve/cve-2017-12637/SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.Tue, 01 Sep 2026 00:00:00 GMTSAPhighcvehttps://0daynews.com/cve/cve-2018-2380/https://0daynews.com/cve/cve-2018-2380/SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.Tue, 01 Sep 2026 00:00:00 GMTSAPmediumcvehttps://0daynews.com/cve/cve-2019-0344/https://0daynews.com/cve/cve-2019-0344/SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2020-6207/https://0daynews.com/cve/cve-2020-6207/SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2020-6287/https://0daynews.com/cve/cve-2020-6287/SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2021-38163/https://0daynews.com/cve/cve-2021-38163/SAP NetWeaver contains a vulnerability that allows unrestricted file upload.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2022-22536/https://0daynews.com/cve/cve-2022-22536/SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2025-31324/https://0daynews.com/cve/cve-2025-31324/SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2025-42999/https://0daynews.com/cve/cve-2025-42999/SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2026-27690/https://0daynews.com/cve/cve-2026-27690/Unauthenticated HTTP request smuggling in SAP AppRouter — the Node.js middleware fronting Business Technology Platform. NVD scored it 9.1. A crafted request can desynchronize the request-response pipeline, exposing other users' responses and knocking the service offline.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2026-44747/https://0daynews.com/cve/cve-2026-44747/Authenticated memory-corruption in NetWeaver Application Server ABAP that NVD scored 9.9 — a logged-in attacker can leverage logical errors in memory management to read data, modify data, or take the application down. Fixed in the SAP July 2026 Security Patch Day.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2026-44761/https://0daynews.com/cve/cve-2026-44761/SAP Commerce Cloud retained a sample OAuth2 client whose credentials were documented in SAP Help Portal. If left unchanged, an unauthenticated attacker can use those well-known values to obtain a valid access token and read or modify tenant data via certain APIs. NVD scored 9.1.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/cve/cve-2026-58231/https://0daynews.com/cve/cve-2026-58231/Insufficient authorization checks and input validation in SAP Commerce Cloud Data Hub Adapter allow unauthenticated remote code execution. CVSS 10.0.Tue, 01 Sep 2026 00:00:00 GMTSAPcriticalcvehttps://0daynews.com/articles/2026-08-14-sap-commerce-cloud-rce-exploitation/https://0daynews.com/articles/2026-08-14-sap-commerce-cloud-rce-exploitation/Defused flagged active exploitation of a max-severity SAP Commerce Cloud RCE within 72 hours of patching. Unpatched instances are live targets now.Fri, 14 Aug 2026 16:30:00 GMTSAParticlehttps://0daynews.com/articles/2026-08-12-sap-commerce-cloud-cve-2026-58231-cvss10-rce/https://0daynews.com/articles/2026-08-12-sap-commerce-cloud-cve-2026-58231-cvss10-rce/SAP patches CVE-2026-58231, a CVSS 10.0 unauthenticated RCE in Commerce Cloud's Data Hub Adapter. Apply the fix now or take the component offline.Wed, 12 Aug 2026 10:00:00 GMTSAParticlehttps://0daynews.com/articles/2026-07-14-sap-july-patch-day-three-criticals-netweaver-approuter-commerce/https://0daynews.com/articles/2026-07-14-sap-july-patch-day-three-criticals-netweaver-approuter-commerce/SAP's July 2026 Security Patch Day fixes 16 flaws — three rated critical, worst a CVSS 9.9 memory-corruption bug in NetWeaver ABAP. No known exploitation yet.Tue, 14 Jul 2026 13:15:00 GMTSAParticle