SAP_SE SAP NetWeaver Application Server Java

Name: SAP_SE SAP NetWeaver Application Server Java
Brand: SAP_SE

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

critical

by severity

0critical0high1medium1low

updated 2026-10-28

vulnerabilities (8)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-0054US	—	0.27% (20th)	Exploit	no fix	2025-02-11	2 versions
CVE-2025-42919US	—	0.50% (43rd)	—	no fix	2025-11-11	2 versions
CVE-2025-42926US	medium5.3OT elevated	0.31% (24th)	—	no fix	2025-09-09	≤ WD-RUNTIME 7.50
CVE-2025-0067US	—OT elevated	0.27% (19th)	—	no fix	2025-01-14	≤ WD-RUNTIME 7.50
CVE-2025-24869US	—OT elevated	0.26% (17th)	—	no fix	2025-02-11	≤ WD-RUNTIME 7.50
CVE-2025-27431US	—	0.22% (13th)	—	no fix	2025-03-11	≤ AJAX-RUNTIME 7.50
CVE-2026-23686US	low3.4	0.19% (9th)	—	no fix	2026-02-10	≤ LMNWABASICAPPS 7.50
CVE-2025-42978US	—	0.15% (4th)	—	no fix	2025-07-08	≤ ENGINEAPI 7.50

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs
CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')1 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-306Missing Authentication for Critical Function1 CVEs
CWE-436Interpretation Conflict1 CVEs
CWE-862Missing Authorization1 CVEs
CWE-863Incorrect Authorization1 CVEs
CWE-940Improper Verification of Source of a Communication Channel1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.