SAP NetWeaver Remote Code Execution Vulnerability

CRITICAL 10.0EXPLOITED (CISA KEV)CVE-2010-5326 · Published 13/05/2016 · updated 16/06/2026

SAP NetWeaver Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
netweaver application server java sap	`≤ 7.30`	No fix yet

Description

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

References

service.sap.com/sap/support/notes/1445998 · Permissions Required
onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions · Broken Link
securityfocus.com/bid/48925 · Third Party Advisory
securityfocus.com/bid/90533 · Third Party Advisory
us-cert.gov/ncas/alerts/TA16-132A · Third Party Advisory
onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2010-5326

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free