{"schema_version":"1","data":[{"id":3707,"advisory_id":"d0fe74fc-ed33-40c8-9732-710e5a7b88f6","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3976","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:39:52.572591+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2016-3976"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver Directory Traversal Vulnerability","summary":"SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2016-3976","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-3976","aliases":["CVE-2016-3976"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-22"],"cveID":"CVE-2016-3976","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3976","dueDate":"2022-05-03","product":"NetWeaver","dateAdded":"2021-11-03","vendorProject":"SAP","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.","vulnerabilityName":"SAP NetWeaver Directory Traversal Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2016-3976","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3705,"advisory_id":"875257db-664c-4bf2-b5a4-888d8ceb429a","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-6287","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:39:51.434088+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2020-6287"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","summary":"SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-6287","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-6287","aliases":["CVE-2020-6287"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-306"],"cveID":"CVE-2020-6287","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-6287","dueDate":"2022-05-03","product":"NetWeaver","dateAdded":"2021-11-03","vendorProject":"SAP","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.","vulnerabilityName":"SAP NetWeaver Missing Authentication for Critical Function Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2020-6287","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3704,"advisory_id":"48b9f925-2949-4f87-bd3e-cd7827c26edd","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-9563","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:39:50.867508+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2016-9563"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver XML External Entity (XXE) Vulnerability","summary":"SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2016-9563","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-9563","aliases":["CVE-2016-9563"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-611"],"cveID":"CVE-2016-9563","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-9563","dueDate":"2022-05-03","product":"NetWeaver","dateAdded":"2021-11-03","vendorProject":"SAP","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.","vulnerabilityName":"SAP NetWeaver XML External Entity (XXE) Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2016-9563","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":3703,"advisory_id":"2b842743-9cb9-4ec3-ba2f-582d28130cc2","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-5326","source_published_at":"2021-11-03T00:00:00+00:00","published_at":"2026-10-24T21:39:50.307753+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2010-5326"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver Remote Code Execution Vulnerability","summary":"SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2010-5326","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2010-5326","aliases":["CVE-2010-5326"],"affected":[],"modified":"2021-11-03T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2010-5326","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-5326","dueDate":"2022-05-03","product":"NetWeaver","dateAdded":"2021-11-03","vendorProject":"SAP","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.","vulnerabilityName":"SAP NetWeaver Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2010-5326","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1482,"advisory_id":"d23750ec-4776-4bd1-b466-7897a6c64a57","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-2388","source_published_at":"2022-06-09T00:00:00+00:00","published_at":"2026-10-24T21:03:02.471677+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2016-2388"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver Information Disclosure Vulnerability","summary":"The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2016-2388","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-2388","aliases":["CVE-2016-2388"],"affected":[],"modified":"2022-06-09T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-200"],"cveID":"CVE-2016-2388","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-2388","dueDate":"2022-06-30","product":"NetWeaver","dateAdded":"2022-06-09","vendorProject":"SAP","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.","vulnerabilityName":"SAP NetWeaver Information Disclosure Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2016-2388","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1481,"advisory_id":"6503df02-5df1-4471-9cc9-6dff12b8c8e8","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-2386","source_published_at":"2022-06-09T00:00:00+00:00","published_at":"2026-10-24T21:03:01.89471+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2016-2386"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver SQL Injection Vulnerability","summary":"SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2016-2386","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-2386","aliases":["CVE-2016-2386"],"affected":[],"modified":"2022-06-09T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-89"],"cveID":"CVE-2016-2386","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-2386","dueDate":"2022-06-30","product":"NetWeaver","dateAdded":"2022-06-09","vendorProject":"SAP","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.","vulnerabilityName":"SAP NetWeaver SQL Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2016-2386","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":1480,"advisory_id":"2fe0a507-be7f-4504-9e2d-3a51ce03cb3b","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-38163","source_published_at":"2022-06-09T00:00:00+00:00","published_at":"2026-10-24T21:03:01.28273+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2021-38163"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver Unrestricted File Upload Vulnerability","summary":"SAP NetWeaver contains a vulnerability that allows unrestricted file upload. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-38163","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-38163","aliases":["CVE-2021-38163"],"affected":[],"modified":"2022-06-09T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-23"],"cveID":"CVE-2021-38163","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38163","dueDate":"2022-06-30","product":"NetWeaver","dateAdded":"2022-06-09","vendorProject":"SAP","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"SAP NetWeaver contains a vulnerability that allows unrestricted file upload.","vulnerabilityName":"SAP NetWeaver Unrestricted File Upload Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2021-38163","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":450,"advisory_id":"868b9bfb-1e0f-448d-aed7-bb5f977c6129","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-12637","source_published_at":"2025-03-19T00:00:00+00:00","published_at":"2026-10-24T20:45:35.799233+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2017-12637"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver Directory Traversal Vulnerability","summary":"SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2017-12637","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-12637","aliases":["CVE-2017-12637"],"affected":[],"modified":"2025-03-19T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-22"],"cveID":"CVE-2017-12637","notes":"SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3476549 ; https://nvd.nist.gov/vuln/detail/CVE-2017-12637","dueDate":"2025-04-09","product":"NetWeaver","dateAdded":"2025-03-19","vendorProject":"SAP","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.","vulnerabilityName":"SAP NetWeaver Directory Traversal Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2017-12637","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":431,"advisory_id":"11748793-3874-43c1-93c8-e816792befba","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31324","source_published_at":"2025-04-29T00:00:00+00:00","published_at":"2026-10-24T20:45:22.876243+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2025-31324"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver Unrestricted File Upload Vulnerability","summary":"SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2025-31324","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-31324","aliases":["CVE-2025-31324"],"affected":[],"modified":"2025-04-29T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-434"],"cveID":"CVE-2025-31324","notes":"https://me.sap.com/notes/3594142 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31324","dueDate":"2025-05-20","product":"NetWeaver","dateAdded":"2025-04-29","vendorProject":"SAP","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.","vulnerabilityName":"SAP NetWeaver Unrestricted File Upload Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2025-31324","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}},{"id":413,"advisory_id":"e1ec81a5-1e18-4f03-8647-74f1ab63c5ef","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-42999","source_published_at":"2025-05-15T00:00:00+00:00","published_at":"2026-10-24T20:45:12.894342+00:00","extraction_method":"structured","technologies":["core-kev","netweaver"],"cve_ids":["CVE-2025-42999"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"SAP NetWeaver Deserialization Vulnerability","summary":"SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2025-42999","products":[{"name":{"value":"NetWeaver","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-42999","aliases":["CVE-2025-42999"],"affected":[],"modified":"2025-05-15T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2025-42999","notes":"SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3604119 ; https://nvd.nist.gov/vuln/detail/CVE-2025-42999","dueDate":"2025-06-05","product":"NetWeaver","dateAdded":"2025-05-15","vendorProject":"SAP","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.","vulnerabilityName":"SAP NetWeaver Deserialization Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2025-42999","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null}}],"next_after":3707,"next_before":413}