SAP shouldn't require
a consultant to survive.

Improper Authorization in SAP Commerce Cloud Data Hub Adapter Allows Unauthenticated RCE

An improper authorization vulnerability in the SAP Commerce Cloud Data Hub Adapter allows an unauthenticated attacker to abuse a default authentication client. Combined with specially crafted input, this enables arbitrary code execution on the underlying server — compromising confidentiality, integrity, and availability of the Commerce Cloud platform and any connected systems. Rated CVSS 10.0 — the maximum score.

Code Injection via XSL Transformation in SAP Manufacturing Integration and Intelligence

A code injection vulnerability in the XSL transformation servlet of SAP Manufacturing Integration and Intelligence (MII) allows a low-privileged attacker to submit malicious input that triggers server-side request forgery (SSRF), enabling the server to fetch attacker-controlled external content and execute arbitrary operating system commands. The attack requires only low privileges on the MII system.

Unauthenticated Memory Corruption via DIAG Protocol in SAP NetWeaver AS ABAP

Improper boundary validation in DIAG protocol parsing within SAP NetWeaver Application Server ABAP allows an unauthenticated remote attacker to send a specially crafted network packet that triggers memory corruption. Successful exploitation can lead to disclosure of sensitive information or complete system crash — and under favourable conditions, arbitrary code execution. DIAG is the native SAP GUI network protocol used by all SAPGUI connections.