SSage

Products

Exploited and recent CVEs

• CVE-2026-68484 Critical 9.0 Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged user 0.3%
• CVE-2026-67403 Critical 9.0 Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources 0.3%
• CVE-2026-67395 Medium 5.9 A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and thei 1.1%
• CVE-2025-1887 High 7.1 SMB forced authentication vulnerability in Sage 200 Spain 0.4%
• CVE-2025-1886 High 7.1 Pass-Back vulnerability in Sage 200 Spain 0.3%
• CVE-2023-2809 High 7.8 Use of Cleartext credentials in Sage 200 Spain 0.4%
• CVE-2020-7390 Medium 4.6 Sage X3 Syracuse Persistent XSS in Edit User page 0.6%
• CVE-2020-7389 Medium 5.5 Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment 2.1%
• CVE-2020-7388 Critical 10.0 Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing 69.4%
• CVE-2020-7387 Medium 5.3 Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor 34.3%