DaystoPatch

VendorsEnterprise apps

SAP

SAP makes enterprise resource planning software (S/4HANA, ECC), the NetWeaver application platform, and business applications for finance, supply chain and HR.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
13 May 2025
Incidents on record
3

Response to exploited bugs

Not rated. 2 reviewed zero-days on record. A grade needs at least 3.

Fixing privately reported bugs

Not rated. No private reports in the grading window.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: not rated. 2 reviewed zero-days in the last 36 months. A grade needs at least 3.
  • First fix within a day for 1 of 2 zero-days. The other one took 2 days.
  • Every supported version fixed within a day for 1 of 2 zero-days. The other one took 2 days.
  • First advisory within a day for 1 of 2 zero-days. The other one took 2 days.
  • Fixing privately reported bugs: not rated. No private reports in the last 36 months.
  • NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.

Response to exploited bugs: sub-scores

  • Time to first advisory1 of 2 zero-days within a day, longest 2 days
    78
    2 cases, low confidence, not used for this vendor
  • Time to first fix1 of 2 zero-days within a day, longest 2 days
    79
    2 cases, low confidence, not used for this vendor
  • Time to fix all versions1 of 2 zero-days within a day, longest 2 days
    79
    2 cases, low confidence, not used for this vendor
  • OpennessNo machine-readable advisory feed listed. 2 of 2 fixed zero-days with a public fix date for every version. 1 of 1 zero-day not fixed within a day had an advisory or mitigation within 72 hours.
    47
    4 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

  • Private fix speedNo private reports in the last 36 months
    NR
    0 cases, not used

Response fingerprint

Median of 2 graded zero-days. Vendor statement 24h, first fix 24h, all versions 24h.

Compressed time scale

Counts toward the response grade 2

  1. 13 May 2025SAP NetWeaver Visual Composer deserialization flaw chained with CVE-2025-31324 (CVE-2025-42999)
  2. 22 Apr 2025SAP NetWeaver Visual Composer zero-day unrestricted file upload (CVE-2025-31324)
Not graded 1: n-days, unreviewed timelines and end-of-life products
  1. 7 Aug 2017SAP NetWeaver AS Java scheduler directory traversal (2017 bug, KEV 2025)Not graded: before window
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

3 in 24 months, 2 with known ransomware use, 100% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
13 May 2025SAP NetWeaver Visual Composer deserialization flaw chained with CVE-2025-31324 (CVE-2025-42999)CVE-2025-429999.10hsame daysame dayFixedCounts toward grade
22 Apr 2025SAP NetWeaver Visual Composer zero-day unrestricted file upload (CVE-2025-31324)CVE-2025-3132410.02d2d2dFixedCounts toward grade
7 Aug 2017SAP NetWeaver AS Java scheduler directory traversal (2017 bug, KEV 2025)CVE-2017-126377.71d1dnot datedFixedNot graded: before window

Private reports

None in the window

Bugs reported privately to SAP by ZDI or Project Zero.

No privately reported cases from ZDI or Project Zero in the window.

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get SAP's own alerts

What we watch

  • BlueskySAP on Bluesky

See sources and health for when each was last read.