CVE-2016-4014

HIGH 8.6CVE-2016-4014 · Published 14/04/2016 · updated 17/06/2026

In short

CVE-2016-4014 is a HIGH (CVSS 8.6) vulnerability affecting netweaver (sap).
Chance of exploitation in the next 30 days (EPSS): 5.3%, higher than 92.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
netweaver sap	`= 7.4`	No fix yet

Description

XML external entity (XXE) vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service (system hang) via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389.

References

packetstormsecurity.com/files/137919/SAP-NetWeaver-AS-JAVA-7.4-XXE-Injection.html · Exploit
seclists.org/fulldisclosure/2016/Jul/45 · Exploit
erpscan.io/advisories/erpscan-16-020-sap-netweaver-java-uddi-component-xxe-vulnerability
erpscan.io/press-center/blog/dos-vulnerabilities-on-the-rise-sap-security-notes-april-2016

More vulnerabilities in netweaver

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

netweaver

sap

= 7.4

No fix yet

More vulnerabilities in netweaver

See all →