Log in Start free

Actively exploited · Published Feb 16, 2016 · Assigned by mitre

CVE-2016-2386

Critical 9.8 Exploited

In plain English

A critical-severity SQL injection in NetWeaver from SAP. Attackers are actively exploiting it in the wild (listed by CISA on June 9, 2022). The chance it is exploited in the next 30 days is estimated at 71.5% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)71.5%top 0.6% of all CVEs
Exploited in the wildYesCISA KEV since Jun 9, 2022
Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 30, 2022.

Official description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References