SAP NetWeaver SQL Injection Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2016-2386 · Published 16/02/2016 · updated 17/06/2026

SAP NetWeaver SQL Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 09/06/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
netweaver application server java sap	`= 7.40`	No fix yet

Description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

References

packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html · Exploit
seclists.org/fulldisclosure/2016/May/56 · Exploit
erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability · Broken Link
erpscan.io/press-center/blog/sap-security-notes-february-2016-review · Broken Link
vah13/SAP_exploit · Exploit
exploit-db.com/exploits/39840 · Exploit
exploit-db.com/exploits/43495 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2016-2386

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free