SAP NetWeaver AS ABAP / ABAP Platform
103 notes since January 2023.
| Patch Day | Note | Title | Priority | CVSS |
|---|---|---|---|---|
| October 2026 | 3689080 | Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP | Medium | 6.4 |
| October 2026 | 3629325 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform | Medium | 6.1 |
| October 2026 | 3671819 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) | Medium | 5.4 |
| September 2026 | 3757002 | Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | High | 7.7 |
| September 2026 | 3772838 | Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform | Medium | 4.3 |
| August 2026 | 3714806 | Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform | Critical | 9.8 |
| August 2026 | 3721424 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP | Medium | 6.3 |
| August 2026 | 3745182 | OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform | Medium | 5.5 |
| August 2026 | 3752864 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) | Medium | 4.2 |
| July 2026 | 3747367 | Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP | Critical | 9.9 |
| July 2026 | 3754659 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) | Medium | 4.7 |
| July 2026 | 3413033 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 4.3 |
| June 2026 | 3746332 | XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform | Critical | 9.9 |
| June 2026 | 3717897 | Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform | Critical | 9.8 |
| June 2026 | 3735546 | Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform | High | 7.1 |
| June 2026 | 3692004 | Open Redirect vulnerability in SAP NetWeaver Application Server ABAP | Medium | 6.1 |
| May 2026 | 3730019 | OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 6.5 |
| May 2026 | 3728690 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) | Medium | 4.7 |
| April 2026 | 3692004 | Open Redirect vulnerability in SAP NetWeaver Application Server ABAP | Medium | 6.1 |
| April 2026 | 3665042 | CSS Injection vulnerability in SAP NetWeaver Application Server ABAP | Low | 3.1 |
| March 2026 | 3689080 | Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP | Medium | 6.4 |
| March 2026 | 3703856 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | Medium | 6.4 |
| March 2026 | 3704740 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | Medium | 5.0 |
| March 2026 | 3694383 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | Low | 3.5 |
| February 2026 | 3674774 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform | Critical | 9.6 |
| February 2026 | 3697567 | XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform | High | 8.8 |
| February 2026 | 3503138 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) | Medium | 6.0 |
| February 2026 | 3678313 | Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) | Low | 3.1 |
| January 2026 | 3688703 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform | High | 8.1 |
| November 2025 | 3643337 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | Medium | 4.3 |
| November 2025 | 3634053 | Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench) | Low | 2.7 |
| November 2025 | 3610322 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | Medium | 4.9 |
| November 2025 | 3626440 | Missing Authorization check in SAP NetWeaver and ABAP Platform | Medium | 4.3 |
| October 2025 | 3503138 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) | Medium | 6.0 |
| October 2025 | 3642021 | Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP | Medium | 5.4 |
| October 2025 | 3627308 | Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform | Medium | 5.3 |
| October 2025 | 3597355 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP | Medium | 6.1 |
| September 2025 | 3302162 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform | Critical | 9.6 |
| September 2025 | 3581811 | Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) | High | 7.7 |
| September 2025 | 3629325 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform | Medium | 6.1 |
| September 2025 | 3610322 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | Medium | 4.9 |
| September 2025 | 3623504 | Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing) | Medium | 4.3 |
| August 2025 | 3611184 | Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document) | High | 8.1 |
| August 2025 | 3585491 | HTML Injection vulnerability in SAP NetWeaver Application Server ABAP | Medium | 6.1 |
| August 2025 | 3597355 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP | Medium | 6.1 |
| August 2025 | 3629871 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform | Medium | 6.1 |
| August 2025 | 3503138 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) | Medium | 6.0 |
| August 2025 | 3602656 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | Medium | 5.4 |
| August 2025 | 3601480 | Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform(Internet Communication Manager) | Medium | 4.1 |
| July 2025 | 3600846 | Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476 | High | 8.1 |
| July 2025 | 3623440 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | High | 8.1 |
| July 2025 | 3617131 | Multiple vulnerabilities in SAP NetWeaver Application Server ABAP | Medium | 6.1 |
| July 2025 | 3596987 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform | Medium | 6.1 |
| July 2025 | 3610322 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | Medium | 4.9 |
| July 2025 | 3626440 | Missing Authorization check in SAP NetWeaver and ABAP Platform | Medium | 4.3 |
| July 2025 | 3610056 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) | Medium | 4.3 |
| June 2025 | 3600840 | Missing Authorization check in SAP NetWeaver Application Server for ABAP | Critical | 9.6 |
| May 2025 | 3577287 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform | Medium | 6.2 |
| April 2025 | 3554667 | Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP | High | 8.5 |
| April 2025 | 3581811 | Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) | High | 7.7 |
| April 2025 | 3559307 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) | Medium | 4.7 |
| April 2025 | 3568778 | Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface) | Medium | 4.3 |
| April 2025 | 3565944 | Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) | Medium | 4.1 |
| March 2025 | 3552824 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) | Medium | 6.1 |
| March 2025 | 3562390 | Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP | Medium | 6.1 |
| February 2025 | 3546470 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) | Medium | 5.3 |
| February 2025 | 3561264 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP | Medium | 5.3 |
| February 2025 | 3547581 | Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI) | Medium | 4.3 |
| January 2025 | 3537476 | Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform | Critical | 9.9 |
| January 2025 | 3550708 | Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform(Internet Communication Framework) | Critical | 9.9 |
| January 2025 | 3550816 | SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform | High | 8.8 |
| January 2025 | 3503138 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) | Medium | 6.0 |
| January 2025 | 3536461 | Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 5.3 |
| January 2025 | 3550674 | Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP | Medium | 4.3 |
| December 2024 | 3469791 | Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP | High | 8.5 |
| December 2024 | 3504390 | NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | High | 7.5 |
| December 2024 | 3536361 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 4.3 |
| November 2024 | 3504390 | NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 5.3 |
| November 2024 | 3508947 | Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 4.3 |
| October 2024 | 3454858 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 4.1 |
| September 2024 | 3501359 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP(CRM Blueprint Application Builder Panel) | Medium | 6.1 |
| September 2024 | 3488039 | Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 5.4 |
| September 2024 | 3496410 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform | Low | 2.7 |
| September 2024 | 3507252 | Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform | Low | 2.0 |
| August 2024 | 3468102 | Improper Access Control in SAP Netweaver Application Server ABAP | Medium | 4.7 |
| August 2024 | 3494349 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform | Medium | 4.3 |
| August 2024 | 3454858 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 4.1 |
| July 2024 | 3456952 | Protection Mechanism Failure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 4.7 |
| July 2024 | 3454858 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 4.1 |
| June 2024 | 3453170 | Denial of service (DOS) in SAP NetWeaver and ABAP platform | Medium | 6.5 |
| June 2024 | 3450286 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform | Medium | 6.1 |
| May 2024 | 3448171 | File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform | Critical | 9.6 |
| May 2024 | 3448445 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform | Medium | 6.5 |
| May 2024 | 3450286 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform | Medium | 6.1 |
| April 2024 | 3359778 | Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform | Medium | 6.5 |
| February 2024 | 3360827 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel) | Medium | 5.3 |
| January 2024 | 3387737 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform | Medium | 4.1 |
| December 2023 | 3392547 | SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform | Medium | 4.1 |
| November 2023 | 3362849 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform | Medium | 5.3 |
| September 2023 | 3323163 | Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering) | Medium | 5.5 |
| August 2023 | 3348000 | Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform | Medium | 4.9 |
| July 2023 | 3318850 | Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform | Medium | 6.0 |
| April 2023 | 3294595 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform | Critical | 9.6 |
| April 2023 | 3296378 | Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform | Medium | 6.5 |
| April 2023 | 3303060 | Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) | Medium | 5.3 |
| March 2023 | 3294595 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform | Critical | 9.6 |
| March 2023 | 3302162 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (SAPRSBRO Program) | Critical | 9.6 |
| March 2023 | 3294954 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform | High | 8.7 |
| March 2023 | 3296346 | Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform | High | 7.4 |
| March 2023 | 3296328 | Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform | Medium | 6.5 |
| March 2023 | 3274585 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) | Medium | 6.1 |
| February 2023 | 3268959 | Multiple vulnerabilities in SAP NetWeaver AS for ABAP and ABAP Platform | Medium | 6.1 |
| February 2023 | 3271227 | URL Redirection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform | Medium | 6.1 |
| February 2023 | 3282663 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (Business Server Pages application) | Medium | 6.1 |
| February 2023 | 3293786 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform | Medium | 6.1 |
| February 2023 | 3274585 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) | Medium | 6.1 |
| February 2023 | 3269151 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) | Medium | 6.1 |
| February 2023 | 3269118 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (BSP Framework) | Medium | 6.1 |
| February 2023 | 3283283 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform | Medium | 6.1 |
| February 2023 | 3287291 | Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform | Low | 3.8 |
| January 2023 | 3089413 | Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform | Critical | 9.0 |
| January 2023 | 3283283 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform | Medium | 6.1 |