CVEvulnerability
CVE-2016-2386
CISA Known Exploited Vulnerability
SAP NetWeaver SQL Injection Vulnerability — SAP NetWeaver
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Added to KEV
- 2022-06-09
- Remediation due
- 2022-06-30
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2016-2386
- Status
- Analyzed
- Published
- 2016-02-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
Affected configurations
• sap netweaver application server java 7.40
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/May/56 Exploit, Mailing List, Third Party Advisory
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/ Broken Link, Third Party Advisory
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ Broken Link, Third Party Advisory
- https://github.com/vah13/SAP_exploit Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/39840/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/43495/ Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/May/56 Exploit, Mailing List, Third Party Advisory
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/ Broken Link, Third Party Advisory
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/ Broken Link, Third Party Advisory
- https://github.com/vah13/SAP_exploit Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/39840/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/43495/ Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386 US Government Resource