ACTIVELY EXPLOITED
CVE-2016-2386: SAP NetWeaver SQL Injection Vulnerability
| Vendor | SAP |
|---|---|
| Product | NetWeaver |
| Actively exploited | Yes |
| Added to CISA KEV | 9 Jun 2022 |
| CISA federal deadline | 30 Jun 2022 |
| Weakness (CWE) | CWE-89 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
SOURCES
Other SAP flaws
- CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability
- CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability
- CVE-2017-12637: SAP NetWeaver Directory Traversal Vulnerability
- CVE-2019-0344: SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
- CVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.