SAP NetWeaver Enterprise Portal vulnerabilities | LiveThreat CVE Feed

Product

SAP NetWeaver Enterprise Portal

by SAP_SE · last CVE Oct 13, 2026

CVEs

On KEV

8.1

Max CVSS

New 30D

Vulnerabilities20 In the news0 Timeline

Severity mix

Critical 0High 1Medium 19Low 0

Severity

All severities20 Critical0 High1 Medium19 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add SAP NetWeaver Enterprise Portal to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-33705	8.1	2%	Sep 15	The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerability which allows an… Affected: < 7.10; < 7.11; < 7.20; < 7.30; < 7.31; < 7.40; +1 more
CVE-2025-42884	6.5	0%	Nov 11	JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal Affected: EP-BASIS 7.50; EP-RUNTIME 7.50
CVE-2026-89122	6.1	0%	Oct 13	Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal Affected: EP-RUNTIME 7.50
CVE-2026-89117	6.1	0%	Oct 13	Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Affected: EP-ADMIN 7.50
CVE-2026-44759	6.1	0%	Jul 14	Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Affected: EP-RUNTIME 7.50
CVE-2026-0499	6.1	0%	Jan 13	Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Affected: EP-RUNTIME 7.50
CVE-2025-42872	6.1	0%	Dec 9	Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Affected: EP-RUNTIME 7.50
CVE-2023-33985	6.1	1%	Jun 13	Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Affected: 7.50
CVE-2022-35225	6.1	1%	Jul 12	SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2022-35172	6.1	1%	Jul 12	SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2022-35170	6.1	1%	Jul 12	SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-controlled inputs over the network, resulting in reflected… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2022-32247	6.1	1%	Jul 12	SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2022-26105	6.1	1%	Apr 12	SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper… Affected: 7.10; 7.11; 7.20; 7.30; 7.31; 7.40; +1 more
CVE-2022-24397	6.1	1%	Mar 9	SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS)… Affected: < 7.30; < 7.31; < 7.40; < 7.50
CVE-2022-24395	6.1	1%	Mar 8	SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site… Affected: < 7.10; < 7.11; < 7.20; < 7.30; < 7.31; < 7.40; +1 more
CVE-2021-33702	6.1	1%	Aug 10	Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data Affected: < 7.10; < 7.11; < 7.20; < 7.30; < 7.31; < 7.40; +1 more
CVE-2026-89118	5.3	0%	Oct 13	Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal Affected: EP-RUNTIME 7.50
CVE-2024-25645	5.3	0%	Mar 12	Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal) Affected: 7.50
CVE-2021-21489	4.8	1%	Sep 14	SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-Site Scripting (XSS)… Affected: < 7.10; < 7.11; < 7.20; < 7.30; < 7.31; < 7.40; +1 more
CVE-2024-44120	4.7	0%	Sep 10	Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Affected: 7.50