Netweaver Application Server Java vulnerabilitiesAnd the versions its exploited flaws hit.
Netweaver Application Server Java is made by SAP. We track 67 published vulnerabilities in it, across 45 versions. 7 of them are on the list of flaws known to be exploited, the newest added on 19 March 2025. If you run Netweaver Application Server Java, check your version against the exploited flaws below and patch those first.
The most recent Netweaver Application Server Java flaw added to the known-exploited list is CVE-2017-12637, on 19 March 2025. We keep watching the known-exploited list.
Which versions of Netweaver Application Server Java do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
- CVE-2017-12637Exploited list, 19 Mar 2025
SAP NetWeaver Directory Traversal Vulnerability
7.50 - CVE-2016-2388Exploited list, 9 Jun 2022
SAP NetWeaver Information Disclosure Vulnerability
7.10 to 7.50 - CVE-2016-2386Exploited list, 9 Jun 2022
SAP NetWeaver SQL Injection Vulnerability
7.40 - CVE-2020-6287Exploited list, 3 Nov 2021
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
7.307.317.407.50 - CVE-2016-3976Exploited list, 3 Nov 2021
SAP NetWeaver Directory Traversal Vulnerability
7.10 to 7.50 - CVE-2010-5326Exploited list, 3 Nov 2021
SAP NetWeaver Remote Code Execution Vulnerability
up to 7.30 - CVE-2016-9563Exploited list, 3 Nov 2021
SAP NetWeaver XML External Entity (XXE) Vulnerability
7.50
Which Netweaver Application Server Java vulnerabilities are being exploited?
7 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.5SAP NetWeaver Directory Traversal Vulnerability
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a ..
- 5.3SAP NetWeaver Information Disclosure Vulnerability
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
- 9.8SAP NetWeaver SQL Injection Vulnerability
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- 10.0SAP NetWeaver Missing Authentication for Critical Function Vulnerability
SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
- 7.5SAP NetWeaver Directory Traversal Vulnerability
SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet.
- 10.0SAP NetWeaver Remote Code Execution Vulnerability
SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.
- 6.5SAP NetWeaver XML External Entity (XXE) Vulnerability
SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.
Which Netweaver Application Server Java flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 95%
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a ..
- 95%
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to...
- 72%
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
- 52%
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
- 47%
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP...
- 28%CVE-2020-6286Medium
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to exploit a...
- 24%
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
- 18%
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as...
- 15%CVE-2016-3974Critical
XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files...
- 4.8%CVE-2020-26829Critical
SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processes because of missing authentication check, that are outside the cluster and...
Running Netweaver Application Server Java? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
- Matched to
- Netweaver Application Server Java on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 67 published vulnerabilities listed under the name Netweaver Application Server Java, across 45 versions. The most recent Netweaver Application Server Java flaw added to the known-exploited list is CVE-2017-12637, on 19 March 2025.
7 are on the list of flaws known to be exploited. The most recently added are CVE-2017-12637, CVE-2016-2388 and CVE-2016-2386.
Each flaw names its own versions, usually as ranges. The newest, CVE-2017-12637, affects 7.50. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track Netweaver Application Server Java. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.