Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-40128: SAP NetWeaver Java Web Container Path Traversal Risk

CVE-2026-40128 · published 4 months ago

Summary

An attacker can send a malicious request to view or modify sensitive SAP files, potentially causing system unavailability. This affects SAP NetWeaver Application Server Java Web Container. To mitigate this risk, ensure SAP software is up-to-date with the latest security patches.

Original advisory text

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.0 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-35Path Traversal: '.../...//'

Timeline

Published9 Jun 2026

Updated4 Nov 2026

First seen9 Jun 2026

Sources

CVE-2026-40128 · NVD

Track software like this

Free during beta