CVE-2016-2386

· CRITICALAnalyzed

← All CVEs

CVSS v3.1

9.8

EPSS

71.06%

Published

Feb 16, 2016

Modified

Apr 21, 2026

CISA Known Exploited Vulnerability

Added: 2022-06-09 · Due: 2022-06-30

Apply updates per vendor instructions.

Public PoC / Exploit (4)

All weaponized →

Exploit-DBSAP NetWeaver J2EE Engine 7.40 - SQL Injection Exploit-DBSAP NetWeaver AS JAVA 7.1 < 7.5 - SQL Injection TrickestTrickest PoC index GitHub PoCmurataydemir/CVE-2016-2386★2

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89CWE-89

Affected Products (1)

sap · netweaver_application_server_javavulnerable

References (15)

http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/May/56

ExploitMailing ListThird Party Advisory

https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/

Broken LinkThird Party Advisory

https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/

Broken LinkThird Party Advisory

https://github.com/vah13/SAP_exploit

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/39840/

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/43495/

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/May/56

ExploitMailing ListThird Party Advisory

https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/

Broken LinkThird Party Advisory

https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/

Broken LinkThird Party Advisory

https://github.com/vah13/SAP_exploit

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/39840/

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/43495/

ExploitThird Party AdvisoryVDB Entry

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386

US Government Resource

KEV Catalog EPSS Scores Vendors All CVEs