SAP · NetWeaver

CVE-2016-9563

SAP NetWeaver XML External Entity (XXE) Vulnerability

Exploited in attacks Medium 6.5 Attack chance: 24%

What it is

BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.

CISA: SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: November 23, 2016
Severity: Medium 6.5 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 24% in the top 2.2% of all known vulnerabilities
Weakness: CWE-611
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from SAP

Added	Vulnerability	Product	Severity	Attack chance
May 15, 2025	DeserializationCVE-2025-42999used by ransomware	NetWeaver	Critical 9.1	13%
Apr 29, 2025	Unrestricted File UploadCVE-2025-31324used by ransomware	NetWeaver	Critical 10.0	99.5%
Mar 19, 2025	Directory TraversalCVE-2017-12637	NetWeaver	High 7.5	95%
Jun 9, 2022	SQL InjectionCVE-2016-2386	NetWeaver	Critical 9.8	72%
Jun 9, 2022	Information DisclosureCVE-2016-2388	NetWeaver	Medium 5.3	52%
Jun 9, 2022	Unrestricted File UploadCVE-2021-38163	NetWeaver	Critical 9.9	37%
Nov 3, 2021	Remote Code ExecutionCVE-2010-5326	NetWeaver	Critical 10.0	18%
Nov 3, 2021	Directory TraversalCVE-2016-3976	NetWeaver	High 7.5	47%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.