Sap S/4 Hana
18 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Sap S/4 Hana, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.
Sap S/4 Hana CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 1 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 2 |
| 2025-04 | 2 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 1 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 18 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High1
- Medium15
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Sap S/4 Hana.
- CVE-2025-42876Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)7.1
- CVE-2025-42899Missing Authorization check in SAP S4CORE (Manage Journal Entries)4.3
- CVE-2025-31328Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)4.6
- CVE-2025-31327OData meta-data property entity tampering in SAP Field Logistics4.3
- CVE-2025-27433Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements)4.3
- CVE-2025-27430Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center)3.5
- CVE-2024-45282HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements)4.3
- CVE-2024-34691Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files)6.5
- CVE-2023-42475Information Disclosure Vulnerability in Statutory Reporting4.3
- CVE-2023-42473Missing Authorization Check In S/4HANA (Manage Withholding Tax Items)5.4
- CVE-2023-40306URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)6.1
- CVE-2023-35870Improper Access Control in SAP S/4HANA (Manage Journal Entry Template)6.3
- CVE-2022-32248Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the data...5.3
- CVE-2022-31597Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a ...5.4
- CVE-2021-33701DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105,...9.1
Product grouping is registry-driven, with AI assist and human review. How it works