SAP NetWeaver Remote Code Execution Vulnerability

概要

参考情報

• service.sap.com/sap/support/notes/1445998 · Permissions Required
• onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions · Broken Link
• securityfocus.com/bid/48925 · Third Party Advisory
• securityfocus.com/bid/90533 · Third Party Advisory
• us-cert.gov/ncas/alerts/TA16-132A · Third Party Advisory
• onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications · Third Party Advisory
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2010-5326

netweaver application server java のその他の脆弱性

• CVE-2026-27674中 6.1Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply c…
• CVE-2026-23686低 3.4Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could s…
• CVE-2025-42926中 5.3SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the…
• CVE-2024-34688高 7.5Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the applicat…
• CVE-2024-28164中 5.3SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which wo…