CISA KEV by vendor
SAP vulnerabilities in the CISA KEV catalogue
14 SAP entries in CISA's Known Exploited Vulnerabilities catalogue, 3 of them (21 percent) known to have been used in ransomware campaigns. First added 3 November 2021, latest 15 May 2025.
Data status: a source is stale
Last synced CISA catalogue version 2026.11.04 (released 4 November 2026) 1,768 entries Updated manually
14entries, 0.8% of the catalogue
3known ransomware use
0added in the last 7 days
0federal due dates in the next 14 days
Products
| Product, as CISA names it | Entries |
|---|---|
| NetWeaver | 10 |
| Commerce Cloud | 1 |
| Multiple Products | 1 |
| Solution Manager | 1 |
| Customer Relationship Management (CRM) | 1 |
Latest additions
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-42999 | NetWeaver | 2025-05-15 | 2025-06-05 | Known | 9.1 Critical | 12.8% | Not auto, total | 3 days + triage |
| CVE-2025-31324 | NetWeaver | 2025-04-29 | 2025-05-20 | Known | 9.8 Critical | 99.4% | Auto, total | 3 days + triage |
| CVE-2017-12637 | NetWeaver | 2025-03-19 | 2025-04-09 | Unknown | 7.5 High | 95.1% | Auto, partial | 3 days |
| CVE-2019-0344 | Commerce Cloud | 2024-09-30 | 2024-10-21 | Unknown | 9.8 Critical | 7.4% | Auto, total | 3 days + triage |
| CVE-2022-22536 | Multiple Products | 2022-08-18 | 2022-09-08 | Unknown | 10.0 Critical | 97.9% | Auto, total | 3 days + triage |
| CVE-2021-38163 | NetWeaver | 2022-06-09 | 2022-06-30 | Unknown | 8.8 High | 36.8% | Not auto, total | 3 days + triage |
| CVE-2016-2388 | NetWeaver | 2022-06-09 | 2022-06-30 | Unknown | 5.3 Medium | 52.2% | Auto, partial | 3 days |
| CVE-2016-2386 | NetWeaver | 2022-06-09 | 2022-06-30 | Unknown | 9.8 Critical | 71.5% | Auto, total | 3 days + triage |
| CVE-2020-6287 | NetWeaver | 2021-11-03 | 2022-05-03 | Unknown | 10.0 Critical | 94.7% | Auto, total | 3 days + triage |
| CVE-2020-6207 | Solution Manager | 2021-11-03 | 2022-05-03 | Unknown | 9.8 Critical | 98.1% | Auto, total | 3 days + triage |
All 14 entries
| CVE | Product | Added | Due | Ransomware | CVSS | EPSS | SSVC | Exposed asset window |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-42999 | NetWeaver | 2025-05-15 | 2025-06-05 | Known | 9.1 Critical | 12.8% | Not auto, total | 3 days + triage |
| CVE-2025-31324 | NetWeaver | 2025-04-29 | 2025-05-20 | Known | 9.8 Critical | 99.4% | Auto, total | 3 days + triage |
| CVE-2017-12637 | NetWeaver | 2025-03-19 | 2025-04-09 | Unknown | 7.5 High | 95.1% | Auto, partial | 3 days |
| CVE-2019-0344 | Commerce Cloud | 2024-09-30 | 2024-10-21 | Unknown | 9.8 Critical | 7.4% | Auto, total | 3 days + triage |
| CVE-2022-22536 | Multiple Products | 2022-08-18 | 2022-09-08 | Unknown | 10.0 Critical | 97.9% | Auto, total | 3 days + triage |
| CVE-2021-38163 | NetWeaver | 2022-06-09 | 2022-06-30 | Unknown | 8.8 High | 36.8% | Not auto, total | 3 days + triage |
| CVE-2016-2388 | NetWeaver | 2022-06-09 | 2022-06-30 | Unknown | 5.3 Medium | 52.2% | Auto, partial | 3 days |
| CVE-2016-2386 | NetWeaver | 2022-06-09 | 2022-06-30 | Unknown | 9.8 Critical | 71.5% | Auto, total | 3 days + triage |
| CVE-2020-6287 | NetWeaver | 2021-11-03 | 2022-05-03 | Unknown | 10.0 Critical | 94.7% | Auto, total | 3 days + triage |
| CVE-2020-6207 | Solution Manager | 2021-11-03 | 2022-05-03 | Unknown | 9.8 Critical | 98.1% | Auto, total | 3 days + triage |
| CVE-2018-2380 | Customer Relationship Management (CRM) | 2021-11-03 | 2022-05-03 | Known | 6.6 Medium | 28.9% | Not auto, partial | 14 days |
| CVE-2016-9563 | NetWeaver | 2021-11-03 | 2022-05-03 | Unknown | 6.5 Medium | 24.2% | Not auto, partial | 14 days |
| CVE-2016-3976 | NetWeaver | 2021-11-03 | 2022-05-03 | Unknown | 7.5 High | 47.2% | Auto, partial | 3 days |
| CVE-2010-5326 | NetWeaver | 2021-11-03 | 2022-05-03 | Unknown | 10.0 Critical | 17.7% | Auto, total | 3 days + triage |
Due dates bind US federal civilian executive branch agencies only (BOD 26-04). Filter SAP in the tracker by date, score or status.
Source: CISA Known Exploited Vulnerabilities Catalog; NVD, FIRST EPSS and CISA SSVC for the scores. This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA does not endorse Sysprobs.