What’s Vulnerable › Vulnerabilities

CVE-2016-2386: SAP NetWeaver SQL Injection Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-06-09
• EPSS: 71.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-02-16 · updated 2026-06-17
• Weakness: CWE-89

Description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

Affected products

• SAP NetWeaver AS Java: 7.40

References

• http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html
• http://seclists.org/fulldisclosure/2016/May/56
• https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
• https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
• https://github.com/vah13/SAP_exploit
• https://www.exploit-db.com/exploits/39840/
• https://www.exploit-db.com/exploits/43495/
• http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html
• http://seclists.org/fulldisclosure/2016/May/56
• https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
• https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
• https://github.com/vah13/SAP_exploit

Get alerted when CVE-2016-2386 or the next vulnerability affects your stack