SAP · NetWeaver

CVE-2021-38163

SAP NetWeaver Unrestricted File Upload Vulnerability

Exploited in attacks Critical 9.9 Attack chance: 37%

What it is

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.

CISA: SAP NetWeaver contains a vulnerability that allows unrestricted file upload.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: June 30, 2022

Added to the CISA list: June 9, 2022
Published: September 14, 2021
Severity: Critical 9.9 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 37% in the top 1.5% of all known vulnerabilities
Weakness: CWE-23
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from SAP

Added	Vulnerability	Product	Severity	Attack chance
May 15, 2025	DeserializationCVE-2025-42999used by ransomware	NetWeaver	Critical 9.1	13%
Apr 29, 2025	Unrestricted File UploadCVE-2025-31324used by ransomware	NetWeaver	Critical 10.0	99.5%
Mar 19, 2025	Directory TraversalCVE-2017-12637	NetWeaver	High 7.5	95%
Jun 9, 2022	SQL InjectionCVE-2016-2386	NetWeaver	Critical 9.8	72%
Jun 9, 2022	Information DisclosureCVE-2016-2388	NetWeaver	Medium 5.3	52%
Nov 3, 2021	Remote Code ExecutionCVE-2010-5326	NetWeaver	Critical 10.0	18%
Nov 3, 2021	Directory TraversalCVE-2016-3976	NetWeaver	High 7.5	47%
Nov 3, 2021	XML External Entity (XXE)CVE-2016-9563	NetWeaver	Medium 6.5	24%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.