SAP NetWeaver Application Server Java vulnerabilities

Product

SAP NetWeaver Application Server Java

by SAP_SE · last CVE Feb 10, 2026

CVEs

On KEV

6.3

Max CVSS

New 30D

Severity mix

Critical 0High 0Medium 6Low 2

Severity

Exploitation

Watch

Add SAP NetWeaver Application Server Java to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-42978	3.5	0%	Jul 8	Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java Affected: ENGINEAPI 7.50
CVE-2026-23686	3.4	0%	Feb 10	CRLF Injection vulnerability in SAP NetWeaver Application Server Java Affected: LMNWABASICAPPS 7.50