ZeroDay Findings
Sign inSign up

Findings

CVE-2016-2386

SAP NetWeaver SQL Injection Vulnerability

Published Feb 16, 2016 · updated Jun 16, 2026 · sap netweaver application server java

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 16, 2016 · Catalog

    Detected

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

  2. Jun 9, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 30, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

Required action

Apply updates per vendor instructions.

CISA due date Jun 30, 2022

Affected

  • cpe sap/netweaver application server java7.40
  • vendor SAP NetWeaverversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2016-2386

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2016-2386

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2016-2386

    30-day exploitation probability 71.5%

    first.org
  • Exploit DatabasePublic exploit reference39840

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference43495

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDVulnerability recordCVE-2016-2386

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

    nvd.nist.gov
  • Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References