How many CVEs does SAP have?

SAP has 1,973 published CVE records since 2002, including 407 in the last two years.

How many SAP CVEs are in CISA KEV?

Yes — 14 of SAP's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which SAP products have the most CVEs?

The SAP products with the most published CVEs are 3d visual enterprise viewer, SAP 3D Visual Enterprise Viewer, netweaver, netweaver_application_server_abap, BusinessObjects Business Intelligence Platform.

What are the most common weakness types in SAP CVEs?

SAP's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-20 (Improper Input Validation), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Are there public exploits for SAP vulnerabilities?

Yes — 238 of SAP's CVEs have a known public exploit.

How many critical SAP vulnerabilities are there?

SAP has 221 critical and 536 high-severity CVEs.

What is the average severity of SAP CVEs?

The average CVSS base score across SAP's scored CVEs is 6.5.

SAP Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: SAP vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

SAP has 1,973 published CVE records since 2002, of which 14 are in CISA's Known Exploited Vulnerabilities catalog and 238 have a known public exploit. The average CVSS base score across scored CVEs is 6.5.

Security scorecard

A quick read on SAP's vulnerability posture, as a share of its 1,973 published CVEs.

Average CVSS: 6.5
Critical / high: 38%
Actively exploited (KEV): 1%
Public exploit available: 12%
Patch available: 5%

Severity and exploitation

How the CVSS severity of SAP's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical221

High536

Medium1,148

Low68

In CISA’s Known Exploited Vulnerabilities catalog

14

14 of SAP's CVEs are confirmed exploited in the wild.

Public exploits

238

238 of SAP's CVEs have a known public exploit available.

Most affected products

The SAP products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in SAP CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish SAP CVE records.

Disclosure activity by year

How many SAP CVEs were published each year.

2019

123

2020

222

2021

207

2022

190

2023

167

2024

141

2025

Latest SAP CVEs

The most recently disclosed vulnerabilities affecting SAP.

Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)
CWE-863
Medium · CVSS 4.3
EPSS 0.2%2026-10-13
Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal
CWE-601
Medium · CVSS 6.1
EPSS 0.1%2026-10-13
Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)
CWE-862
Medium · CVSS 4.7
EPSS 0.1%2026-10-13
Missing authorization check in SAP ABAP Platform

Other vendors

CVE counts for other vendors.

Sourcecodester2,201 CVEs Tenda2,089 CVEs Intel2,055 CVEs Dell1,995 CVEs Jenkins1,941 CVEs D-Link1,910 CVEs Samsung1,746 CVEs sun1,711 CVEs

Browse all vendors

Frequently asked questions

Common questions about SAP vulnerabilities.

How many CVEs does SAP have?: SAP has 1,973 published CVE records since 2002, including 407 in the last two years.
How many SAP CVEs are in CISA KEV?: Yes — 14 of SAP's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which SAP products have the most CVEs?: The SAP products with the most published CVEs are 3d visual enterprise viewer, SAP 3D Visual Enterprise Viewer, netweaver, netweaver_application_server_abap, BusinessObjects Business Intelligence Platform.
What are the most common weakness types in SAP CVEs?: SAP's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-862 (Missing Authorization), CWE-20 (Improper Input Validation), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
Are there public exploits for SAP vulnerabilities?: Yes — 238 of SAP's CVEs have a known public exploit.
How many critical SAP vulnerabilities are there?: SAP has 221 critical and 536 high-severity CVEs.
What is the average severity of SAP CVEs?: The average CVSS base score across SAP's scored CVEs is 6.5.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.