Sap Sap_basis
18 CVEs affecting Sap Sap_basis. Latest disclosed: 2026-02-10. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0066 | Critical | 9.9 | 2025-01-14 | Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due… |
CVE-2026-23687 | High | 8.8 | 2026-02-10 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modif… |
CVE-2025-0063 | High | 8.8 | 2025-01-14 | SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with ba… |
CVE-2016-4551 | High | 7.5 | 2016-10-05 | The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Securi… |
CVE-2026-0484 | Medium | 6.5 | 2026-02-10 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code… |
CVE-2025-0058 | Medium | 6.5 | 2025-01-14 | In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view se… |
CVE-2024-34687 | Medium | 6.5 | 2024-05-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerab… |
CVE-2025-42956 | Medium | 6.1 | 2025-07-08 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. W… |
CVE-2025-42936 | Medium | 5.4 | 2025-08-12 | The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allo… |
CVE-2025-23193 | Medium | 5.3 | 2025-02-11 | SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of… |
CVE-2025-0053 | Medium | 5.3 | 2025-01-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL param… |
CVE-2026-24312 | Medium | 5.2 | 2026-02-10 | An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by l… |
CVE-2025-42911 | Medium | 5.0 | 2025-09-09 | SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the… |
CVE-2024-34689 | Medium | 5.0 | 2024-07-09 | WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting… |
CVE-2024-39599 | Medium | 4.7 | 2024-07-09 | Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured malware scanner API… |
CVE-2025-42918 | Medium | 4.3 | 2025-09-09 | SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameter… |
CVE-2025-42986 | Medium | 4.3 | 2025-07-08 | Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Func… |
CVE-2024-37180 | Medium | 4.1 | 2024-07-09 | Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no furthe… |