CVE-2016-7435

CRITICAL 9.1CVE-2016-7435 · Published 05/10/2016 · updated 17/06/2026

In short

CVE-2016-7435 is a CRITICAL (CVSS 9.1) vulnerability affecting netweaver (sap).
Chance of exploitation in the next 30 days (EPSS): 3.3%, higher than 88.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
netweaver sap	`= 7.40`	No fix yet

Description

The (1) SCTC_REFRESH_EXPORT_TAB_COMP, (2) SCTC_REFRESH_CHECK_ENV, and (3) SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via vectors involving a CALL 'SYSTEM' statement, aka SAP Security Note 2260344.

References

seclists.org/fulldisclosure/2016/Oct/0 · Mailing List
seclists.org/fulldisclosure/2016/Oct/1 · Mailing List
seclists.org/fulldisclosure/2016/Oct/2 · Mailing List
securityfocus.com/bid/93272
onapsis.com/blog/analyzing-sap-security-notes-march-2016 · Third Party Advisory
onapsis.com/research/security-advisories/sap-os-command-injection-sctcrefreshcheckenv · Third Party Advisory
onapsis.com/research/security-advisories/sap-os-command-injection-sctcrefreshexporttabcomp · Third Party Advisory
onapsis.com/research/security-advisories/sap-os-command-injection-sctctmsmaintainalog · Third Party Advisory

More vulnerabilities in netweaver

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

netweaver

sap

= 7.40

No fix yet

Description

More vulnerabilities in netweaver

See all →