SAP · NetWeaver
CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability
What it is
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
CISA: SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- May 13, 2016
- Severity
- Critical 10.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 18% in the top 2.9% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (6)
- http://www.securityfocus.com/bid/90533
- https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications
- http://service.sap.com/sap/support/notes/1445998
- http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detou…
- http://www.us-cert.gov/ncas/alerts/TA16-132A
- http://www.securityfocus.com/bid/48925
More exploited flaws from SAP
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 15, 2025 | Deserialization | NetWeaver | Critical 9.1 | 13% |
| Apr 29, 2025 | Unrestricted File Upload | NetWeaver | Critical 10.0 | 99.5% |
| Mar 19, 2025 | Directory Traversal | NetWeaver | High 7.5 | 95% |
| Jun 9, 2022 | SQL Injection | NetWeaver | Critical 9.8 | 72% |
| Jun 9, 2022 | Information Disclosure | NetWeaver | Medium 5.3 | 52% |
| Jun 9, 2022 | Unrestricted File Upload | NetWeaver | Critical 9.9 | 37% |
| Nov 3, 2021 | Directory Traversal | NetWeaver | High 7.5 | 47% |
| Nov 3, 2021 | XML External Entity (XXE) | NetWeaver | Medium 6.5 | 24% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.