---
title: "SAP: known exploited vulnerabilities"
url: https://erroneo.us/security/vendor/sap/
description: "Every SAP vulnerability in CISA's Known Exploited Vulnerabilities catalog since October 2023 (4), newest first, with due dates and fixes."
type: vendor
section: "Security Digest"
date_modified: 2025-05-15
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# SAP: known exploited vulnerabilities

- 2025-05-15 [CVE-2025-42999](https://erroneo.us/security/cve/CVE-2025-42999/index.md) SAP NetWeaver: SAP NetWeaver Deserialization Vulnerability (due 2025-06-05; ransomware: Known)
- 2025-04-29 [CVE-2025-31324](https://erroneo.us/security/cve/CVE-2025-31324/index.md) SAP NetWeaver: SAP NetWeaver Unrestricted File Upload Vulnerability (due 2025-05-20; ransomware: Known)
- 2025-03-19 [CVE-2017-12637](https://erroneo.us/security/cve/CVE-2017-12637/index.md) SAP NetWeaver: SAP NetWeaver Directory Traversal Vulnerability (due 2025-04-09; ransomware: Unknown)
- 2024-09-30 [CVE-2019-0344](https://erroneo.us/security/cve/CVE-2019-0344/index.md) SAP Commerce Cloud: SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability (due 2024-10-21; ransomware: Unknown)

---
Source page: https://erroneo.us/security/vendor/sap/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt