Security feed

24 October 2026

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver Directory Traversal Vulnerability

SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files. CISA required action: Apply updates per vendor instructions.

NetWeaver CVE-2016-3976

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2016-3976

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2016-3976
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3707 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:39:52 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver Missing Authentication for Critical Function Vulnerability

SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users. CISA required action: Apply updates per vendor instructions.

NetWeaver CVE-2020-6287

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-6287

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2020-6287
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3705 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:39:51 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver XML External Entity (XXE) Vulnerability

SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks. CISA required action: Apply updates per vendor instructions.

NetWeaver CVE-2016-9563

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2016-9563

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2016-9563
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3704 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:39:50 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver Remote Code Execution Vulnerability

SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request. CISA required action: Apply updates per vendor instructions.

NetWeaver CVE-2010-5326

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2010-5326

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2010-5326
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3703 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:39:50 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver Information Disclosure Vulnerability

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. CISA required action: Apply updates per vendor instructions.

NetWeaver CVE-2016-2388

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2016-2388

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2016-2388
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1482 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:03:02 GMT
Publisher date: Thu, 09 Jun 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver SQL Injection Vulnerability

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. CISA required action: Apply updates per vendor instructions.

NetWeaver CVE-2016-2386

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2016-2386

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2016-2386
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1481 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:03:01 GMT
Publisher date: Thu, 09 Jun 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP NetWeaver contains a vulnerability that allows unrestricted file upload. CISA required action: Apply updates per vendor instructions.

NetWeaver CVE-2021-38163

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-38163

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-38163
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1480 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:03:01 GMT
Publisher date: Thu, 09 Jun 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver Directory Traversal Vulnerability

SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

NetWeaver CVE-2017-12637

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-12637

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-12637
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #450 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:45:35 GMT
Publisher date: Wed, 19 Mar 2025 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

NetWeaver CVE-2025-31324

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2025-31324

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2025-31324
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #431 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:45:22 GMT
Publisher date: Tue, 29 Apr 2025 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

SAP NetWeaver Deserialization Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

NetWeaver CVE-2025-42999

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2025-42999

NetWeaver

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2025-42999
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #413 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:45:12 GMT
Publisher date: Thu, 15 May 2025 00:00:00 GMT

Read the original announcement