SAP SE SAP NetWeaver Enterprise Portal vulnerabilities

8 CVEs affecting SAP SE SAP NetWeaver Enterprise Portal, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-89122, published 2026-10-13.

More from SAP SE.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-44759, published 2026-07-14. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser…
• CVE-2025-42884, published 2025-11-11. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI…
• CVE-2025-42872, published 2025-12-09. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers,…
• CVE-2024-44120, published 2024-09-10. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and…
• CVE-2026-89118, published 2026-10-13. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but…
• CVE-2026-0499, published 2026-01-13. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser…
• CVE-2026-89117, published 2026-10-13. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser…
• CVE-2026-89122, published 2026-10-13. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads…