SAP Business Connector vulnerabilities

7 CVEs affecting SAP Business Connector, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0514, published 2026-01-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2006-0731, published 2006-02-16. Medium severity, CVSS 4.0. EPSS: 2.7% chance of exploitation in the next 30 days. WmRoot/adapter-index.dsp in SAP Business Connector Core Fix 7 and earlier allows remote attackers to conduct spoofing (phishing) attacks via an absolute URL in the url parameter, which loads the URL…
CVE-2006-0732, published 2006-02-16. Medium severity, CVSS 6.4. EPSS: 2.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the fullName parameter to (1) sapbc/SAP/chopSAPLog.dsp or…
CVE-2025-42892, published 2025-11-11. Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days. Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the…
CVE-2025-42894, published 2025-11-11. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the…
CVE-2025-42886, published 2025-11-11. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated…
CVE-2025-42893, published 2025-11-11. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site…
CVE-2026-0514, published 2026-01-13. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be…