CVE-2026-40128

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3727078
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) SAP NetWeaver Servidor de Aplicaciones Java (Contenedor Web) permite a un atacante no autenticado crear una solicitud de inicio de sesión HTTP maliciosa que manipula los parámetros de inclusión de ficheros, lo que permite el salto de ruta y el procesamiento del fichero incluido. El procesamiento del fichero incluido podría permitir al atacante ver o modificar información sensible o dejar cualquier parte del sistema local no disponible.

09 Jun 2026, 01:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 01:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-40128

Mitre link : CVE-2026-40128

CVE.ORG link : CVE-2026-40128

JSON object : View

Products Affected

No product.

CWE

CWE-35

Path Traversal: '.../...//'

{"id": "CVE-2026-40128", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40128", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Application Server Java (Web Container)", "versions": [{"status": "affected", "version": "ENGINEAPI 7.50"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T01:16:46.050", "references": [{"url": "https://me.sap.com/notes/3727078", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-35"}]}], "descriptions": [{"lang": "en", "value": "SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable."}, {"lang": "es", "value": "SAP NetWeaver Servidor de Aplicaciones Java (Contenedor Web) permite a un atacante no autenticado crear una solicitud de inicio de sesi\u00f3n HTTP maliciosa que manipula los par\u00e1metros de inclusi\u00f3n de ficheros, lo que permite el salto de ruta y el procesamiento del fichero incluido. El procesamiento del fichero incluido podr\u00eda permitir al atacante ver o modificar informaci\u00f3n sensible o dejar cualquier parte del sistema local no disponible."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "cna@sap.com"}