SAP: CISA KEV History
Every SAP vulnerability in the CISA Known Exploited Vulnerabilities catalog: confirmed in-the-wild exploitation, addition timeline, and ransomware linkage. Rebuilt automatically on every site deploy.
Snapshot: 2026-09-08 · Source: CISA KEV Catalog · Full KEV dashboard
KEV entries
14
Added, last 12 months
0
Ransomware-linked
3
Latest addition
2025-05-15
SAP KEV additions per month, last 24 months
Most-listed products: NetWeaver, Commerce Cloud, Multiple Products, Customer Relationship Management (CRM), Solution Manager.
Latest 14 of 14 SAP KEV entries
| CVE | Vulnerability | Added | Ransomware |
|---|---|---|---|
| CVE-2025-42999 | SAP NetWeaver Deserialization Vulnerability | 2025-05-15 | Yes |
| CVE-2025-31324 | SAP NetWeaver Unrestricted File Upload Vulnerability | 2025-04-29 | Yes |
| CVE-2017-12637 | SAP NetWeaver Directory Traversal Vulnerability | 2025-03-19 | No |
| CVE-2019-0344 | SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | 2024-09-30 | No |
| CVE-2022-22536 | SAP Multiple Products HTTP Request Smuggling Vulnerability | 2022-08-18 | No |
| CVE-2021-38163 | SAP NetWeaver Unrestricted File Upload Vulnerability | 2022-06-09 | No |
| CVE-2016-2386 | SAP NetWeaver SQL Injection Vulnerability | 2022-06-09 | No |
| CVE-2016-2388 | SAP NetWeaver Information Disclosure Vulnerability | 2022-06-09 | No |
| CVE-2018-2380 | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability | 2021-11-03 | Yes |
| CVE-2010-5326 | SAP NetWeaver Remote Code Execution Vulnerability | 2021-11-03 | No |
| CVE-2016-9563 | SAP NetWeaver XML External Entity (XXE) Vulnerability | 2021-11-03 | No |
| CVE-2020-6287 | SAP NetWeaver Missing Authentication for Critical Function Vulnerability | 2021-11-03 | No |
| CVE-2020-6207 | SAP Solution Manager Missing Authentication for Critical Function Vulnerability | 2021-11-03 | No |
| CVE-2016-3976 | SAP NetWeaver Directory Traversal Vulnerability | 2021-11-03 | No |
CVE links go to our explainer when one exists, otherwise to the NVD record.
Data: official CISA KEV catalog, fetched at build time. Figures may be reused with attribution to East Bay Cyber and CISA. See also the KEV Velocity Dashboard and all tracked vendors.