SAP NetWeaver

5 known vulnerabilities in SAP NetWeaver, 4 critical, 3 actively exploited, with patch priority, exploit likelihood and the news covering them.

Recently exploited

  • CVE-2025-42999 CVSS 9.1 critical · actively exploited SAP NetWeaver Deserialization Vulnerability
  • CVE-2025-31324 CVSS 9.8 critical · actively exploited SAP NetWeaver Unrestricted File Upload Vulnerability
  • CVE-2021-38163 CVSS 8.8 high · actively exploited SAP NetWeaver Unrestricted File Upload Vulnerability

Latest vulnerabilities

  • CVE-2026-66768 CVSS 9.0 critical SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A…
  • CVE-2026-58240 CVSS 9.8 critical SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during…
  • CVE-2025-42999 CVSS 9.1 critical · actively exploited SAP NetWeaver Deserialization Vulnerability
  • CVE-2025-31324 CVSS 9.8 critical · actively exploited SAP NetWeaver Unrestricted File Upload Vulnerability
  • CVE-2021-38163 CVSS 8.8 high · actively exploited SAP NetWeaver Unrestricted File Upload Vulnerability