NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in SAP-producten
view advisory published 2026-07-14
SAP heeft kwetsbaarheden verholpen in SAP NetWeaver Application Server ABAP, SAP Approuter, SAP Commerce Cloud, SAP NetWeaver Application Server Java, SAProuter, SAP Change and Transport System Attach Tool, SAP NetWeaver Enterprise Portal, SAP S/4HANA modules, SAP Fiori Launchpad, SAP CRM WebClient UI, SAP HANA Database user self service tools, en SAP Commerce Cloud. Update: Door een verwerkingsfout waren geen referenties meegegeven. Dit is hersteld. Er zijn verder geen inhoudelijke wijzigingen
01
describes (24)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-58233US | — | — | ||
SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s libra… | ||||
| CVE-2026-44771US | —OT elevated | — | ||
SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in esc… | ||||
| CVE-2026-44770US | —OT elevated | — | ||
SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys resulting in disclosure… | ||||
| CVE-2026-44769US | — | — | ||
SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low… | ||||
| CVE-2026-44768US | — | — | ||
SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuratio… | ||||
| CVE-2026-44767US | — | — | ||
setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link re… | ||||
| CVE-2026-44761US | —OT elevated | — | ||
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation.… | ||||
| CVE-2026-44760US | — | — | ||
Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into th… | ||||
| CVE-2026-44759US | — | — | ||
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed i… | ||||
| CVE-2026-44753US | — | — | ||
SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid… | ||||
| CVE-2026-44752US | — | — | ||
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes… | ||||
| CVE-2026-44747US | — | — | ||
SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized… | ||||
| CVE-2026-44745US | — | — | ||
SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft… | ||||
| CVE-2026-27690US | — | — | ||
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchroniz… | ||||
| CVE-2026-0487US | — | — | ||
SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. Thi… | ||||
| CVE-2026-40128US | — | — | ||
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enablin… | ||||
| CVE-2026-24315US | — | — | ||
SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by st… | ||||
| CVE-2026-43515US | — | Exploit | ||
Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-… | ||||
| CVE-2026-43512US | — | Exploit | ||
DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1… | ||||
| CVE-2026-41293US | — | Exploit | ||
Improper Input Validation vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9… | ||||
showing 20 of 24
02
references
External citations — patches, advisories, analysis.
- Referenceexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan