Sap Netweaver Application Server Java
13 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Sap Netweaver Application Server Java, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.
Sap Netweaver Application Server Java CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 1 |
| 2025-02 | 2 |
| 2025-03 | 1 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 1 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 13 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High2
- Medium8
- Low2
Latest CVEs
The 13 most recently published vulnerabilities affecting Sap Netweaver Application Server Java.
- CVE-2026-23686CRLF Injection vulnerability in SAP NetWeaver Application Server Java3.4
- CVE-2025-42919Information Disclosure vulnerability in SAP NetWeaver Application Server Java5.3
- CVE-2025-42926Missing Authentication check in SAP NetWeaver Application Server Java5.3
- CVE-2025-42978Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java3.5
- CVE-2025-27431Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java5.4
- CVE-2025-24869Information Disclosure vulnerability in SAP NetWeaver Application Server Java4.3
- CVE-2025-0054Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java5.4
- CVE-2025-0067Missing Authorization check in SAP NetWeaver Application Server Java6.3
- CVE-2022-22533Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an attacker could sub...7.5
- CVE-2022-22532In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted H...9.8
- CVE-2020-6365SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote attacker to redirect users to a malicious site due to insufficient reverse ta...6.1
- CVE-2020-6319SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different ...6.1
- CVE-2015-4091XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to...7.5
Product grouping is registry-driven, with AI assist and human review. How it works