SAP
CVEs currently on EVULNABLE's Priority Feed for SAP, and this vendor's own CISA KEV history.
In EVULNABLE's ranked feed
Showing all 14 SAP CVEs in EVULNABLE's ranked feed.
#1 95 Immediate CVE-2025-31324 ExigentKEV since 2025 · listed over a yearRansomwareCISA KEV SAP — SAP NetWeaver Unrestricted File Upload Vulnerability KEV + ransomware, EPSS 99.5%
EVRS 95/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.
#2 87 Immediate CVE-2020-6207 ExigentKEV since 2021 · listed over a yearCISA KEV SAP — SAP Solution Manager Missing Authentication for Critical Function Vulnerability KEV, EPSS 98.1%
EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.981.
#3 87 Immediate CVE-2022-22536 ExigentKEV since 2022 · listed over a yearCISA KEV SAP — SAP Multiple Products HTTP Request Smuggling Vulnerability KEV, EPSS 97.9%
EVRS 87/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.979.
#4 86 Immediate CVE-2020-6287 ExigentKEV since 2021 · listed over a yearCISA KEV SAP — SAP NetWeaver Missing Authentication for Critical Function Vulnerability KEV, EPSS 94.7%
EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.947.
#5 85 Immediate CVE-2025-42999 ExigentKEV since 2025 · listed over a yearRansomwareCISA KEV SAP — SAP NetWeaver Deserialization Vulnerability KEV + ransomware, EPSS 12.7%
EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.
#6 84 Urgent CVE-2017-12637 KEV since 2025 · listed over a yearCISA KEV SAP — SAP NetWeaver Directory Traversal Vulnerability KEV, EPSS 95.1%
EVRS 84/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.951.
#7 79 Urgent CVE-2016-2386 KEV since 2022 · listed over a yearCISA KEV SAP — SAP NetWeaver SQL Injection Vulnerability KEV, EPSS 71.5%
EVRS 79/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.715.
#8 75 Urgent CVE-2016-2388 KEV since 2022 · listed over a yearCISA KEV SAP — SAP NetWeaver Information Disclosure Vulnerability KEV, EPSS 52.2%
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.522.
#9 75 Urgent CVE-2016-3976 KEV since 2021 · listed over a yearCISA KEV SAP — SAP NetWeaver Directory Traversal Vulnerability KEV, EPSS 47.3%
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.473.
#10 75 Urgent CVE-2021-38163 KEV since 2022 · listed over a yearCISA KEV SAP — SAP NetWeaver Unrestricted File Upload Vulnerability KEV, EPSS 36.9%
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.369.
#11 75 Urgent CVE-2018-2380 KEV since 2021 · listed over a yearRansomwareCISA KEV SAP — SAP Customer Relationship Management (CRM) Path Traversal Vulnerability KEV + ransomware, EPSS 28.9%
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.
#12 75 Urgent CVE-2016-9563 KEV since 2021 · listed over a yearCISA KEV SAP — SAP NetWeaver XML External Entity (XXE) Vulnerability KEV, EPSS 24.2%
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.242.
#13 75 Urgent CVE-2010-5326 KEV since 2021 · listed over a yearCISA KEV SAP — SAP NetWeaver Remote Code Execution Vulnerability KEV, EPSS 17.8%
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.178.
#14 75 Urgent CVE-2019-0344 KEV since 2024 · listed over a yearCISA KEV SAP — SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability KEV, EPSS 7.1%
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.071.