CVE-2016-2386

SAP NetWeaver SQL Injection Vulnerability

SAP — NetWeaver

Added to KEV catalog: 9 June 2022
Federal remediation due date: 30 June 2022
Weakness classification (CWE): CWE-89

CISA Description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2016-2386

View on NVD View on MITRE CVE View full CISA catalog

More SAP Vulnerabilities

CVE-2025-42999

SAP NetWeaver Deserialization Vulnerability

CVE-2025-31324

SAP NetWeaver Unrestricted File Upload Vulnerability

CVE-2017-12637

SAP NetWeaver Directory Traversal Vulnerability

CVE-2019-0344

SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability

CVE-2022-22536

SAP Multiple Products HTTP Request Smuggling Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services