SAP NetWeaver Application Server Java vulnerabilities

Product

SAP NetWeaver Application Server Java

by SAP_SE · last CVE Feb 10, 2026

CVEs

On KEV

6.3

Max CVSS

New 30D

Severity mix

Critical 0High 0Medium 6Low 2

Severity

Exploitation

Watch

Add SAP NetWeaver Application Server Java to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-0067	6.3	0%	Jan 14	Missing Authorization check in SAP NetWeaver Application Server Java Affected: WD-RUNTIME 7.50
CVE-2025-27431	5.4	0%	Mar 11	Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java Affected: AJAX-RUNTIME 7.50
CVE-2025-0054	5.4	0%	Feb 11	Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java Affected: EP-BASIS 7.50; FRAMEWORK-EXT 7.50
CVE-2025-42919	5.3	0%	Nov 11	Information Disclosure vulnerability in SAP NetWeaver Application Server Java Affected: ENGINEAPI 7.50; EP-BASIS 7.50
CVE-2025-42926	5.3	0%	Sep 9	Missing Authentication check in SAP NetWeaver Application Server Java Affected: WD-RUNTIME 7.50
CVE-2025-24869	4.3	0%	Feb 11	Information Disclosure vulnerability in SAP NetWeaver Application Server Java Affected: WD-RUNTIME 7.50
CVE-2025-42978	3.5	0%	Jul 8	Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java Affected: ENGINEAPI 7.50
CVE-2026-23686	3.4	0%	Feb 10	CRLF Injection vulnerability in SAP NetWeaver Application Server Java Affected: LMNWABASICAPPS 7.50