SAP s/4hana vulnerabilities

17 CVEs affecting SAP s/4hana, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0488, published 2026-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-38176, published 2021-09-14. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in Solution Section to execute manipulated query or inject…
CVE-2020-6184, published 2020-02-12. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode…
CVE-2022-22530, published 2022-01-14. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to…
CVE-2022-22542, published 2022-02-09. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. S/4HANA Supplier Factsheet exposes the private address and bank details of an Employee Business Partner with Supplier Role, AND Enterprise Search for Customer, Supplier and Business Partner objects…
CVE-2022-22531, published 2022-01-14. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloaded files. This allows an attacker with basic user rights to…
CVE-2020-6316, published 2020-11-10. Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days. SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leading to Missing Authorization check.
CVE-2022-31589, published 2022-06-14. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction,…
CVE-2022-32248, published 2022-07-12. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the…
CVE-2020-6212, published 2020-04-24. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA (versions 100, 101, 102, 103, 104) do…
CVE-2020-6214, published 2020-04-14. Medium severity, CVSS 4.7. EPSS: 0.6% chance of exploitation in the next 30 days. SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected with other authorization objects,…

Latest

CVE-2026-0488, published 2026-02-10. Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days. An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the…
CVE-2023-42475, published 2023-10-10. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.
CVE-2023-42473, published 2023-10-10. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the…
CVE-2023-40306, published 2023-09-08. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight…
CVE-2023-24524, published 2023-02-14. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to…
CVE-2022-31597, published 2022-07-12. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a…