What’s Vulnerable › Vulnerabilities

CVE-2016-9832

• Severity: critical (CVSS 9.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-12-10 · updated 2026-06-17
• Weakness: CWE-74

Description

PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS, as demonstrated by WEBGUI or Report.

Affected products

• Pwc Ace-Advanced Business Application Programming: 8.10.304

References

• http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html
• http://seclists.org/fulldisclosure/2016/Dec/33
• http://www.securityfocus.com/archive/1/539883/100/0/threaded
• http://www.securityfocus.com/archive/1/539883/30/0/threaded
• http://www.securityfocus.com/bid/94733
• https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security
• http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html
• http://seclists.org/fulldisclosure/2016/Dec/33
• http://www.securityfocus.com/archive/1/539883/100/0/threaded
• http://www.securityfocus.com/archive/1/539883/30/0/threaded
• http://www.securityfocus.com/bid/94733
• https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security

Get alerted when CVE-2016-9832 or the next vulnerability affects your stack