Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2016-2386: SAP NetWeaver lets attackers run database commands
CVE-2016-2386 · published 10 years ago · actively exploited
Summary
The UDDI service in SAP NetWeaver J2EE Engine version 7.40 can be tricked into executing unwanted database commands from outside your network. An attacker could read, change, or delete data stored in your system. Install the latest SAP security updates and limit access to the UDDI service through firewalls or network controls.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sap | netweaver | All versions |
| sap | netweaver_application_server_java |
7.40 cpe:2.3:a:sap:netweaver_application_server_java:7.40:*:*:*:*:*:*:* |
Original advisory text
SAP NetWeaver SQL Injection Vulnerability
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
References
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Inject... Exploit Third Party Advisory VDB Entry
- http://seclists.org/fulldisclosure/2016/May/56 Exploit Mailing List Third Party Advisory
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vul... Broken Link Third Party Advisory
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ Broken Link Third Party Advisory
- https://github.com/vah13/SAP_exploit Exploit Third Party Advisory
- https://www.exploit-db.com/exploits/39840/ Exploit Third Party Advisory VDB Entry
- https://www.exploit-db.com/exploits/43495/ Exploit Third Party Advisory VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
72%
chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published16 Feb 2016
Updated20 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta