SAP Basis vulnerabilities

18 CVEs affecting SAP Basis, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-24312, published 2026-02-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-4551, published 2016-10-05. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the…
CVE-2025-0063, published 2025-01-14. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over…
CVE-2025-0066, published 2025-01-14. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have…
CVE-2026-23687, published 2026-02-10. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the…
CVE-2024-34687, published 2024-05-14. Critical severity, CVSS 9.0. EPSS: 0.4% chance of exploitation in the next 30 days. SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that…
CVE-2024-34689, published 2024-07-09. Medium severity, CVSS 5.0. EPSS: 0.4% chance of exploitation in the next 30 days. WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On…
CVE-2025-23193, published 2025-02-11. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing…
CVE-2025-0053, published 2025-01-14. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could…
CVE-2025-0058, published 2025-01-14. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should…
CVE-2024-39599, published 2024-07-09. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API because of a programming error. This…

Latest

CVE-2026-24312, published 2026-02-10. Medium severity, CVSS 5.2. EPSS: 0.2% chance of exploitation in the next 30 days. An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by leveraging permissions from a less…
CVE-2026-0484, published 2026-02-10. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code and modify the text data in the system.…
CVE-2025-42918, published 2025-09-09. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on…
CVE-2025-42911, published 2025-09-09. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This…
CVE-2025-42936, published 2025-08-12. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access…
CVE-2025-42956, published 2025-07-08. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. When an authenticated victim clicks on…
CVE-2025-42986, published 2025-07-08. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing…