CVEvulnerability

CVE-2010-5326

10.0 CRITICAL Known exploited Published 2016-05-13 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

SAP NetWeaver Remote Code Execution Vulnerability — SAP NetWeaver

SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.

Added to KEV: 2021-11-03
Remediation due: 2022-05-03
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2010-5326

Status: Analyzed
Published: 2016-05-13
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses: CWE-306

Description

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

Affected configurations

• sap netweaver application server java (<= 7.30)

Weakness · CWE (1)

CWE-306 Missing Authentication for Critical Functionality weakness

References