CVE-2016-2386VulnerabilityPublished 06/09/2022Updated 10/24/2026

CVE-2016-2386: SAP NetWeaver SQL Injection Vulnerability

Affects SAP NetWeaverSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 06/09/2022
KEV deadline: 06/30/2022
EPSS: 71.5% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-2386 (opens in a new tab)

Description

CVE-2016-2386 is a high-severity SQL injection vulnerability in the UDDI server component of SAP NetWeaver J2EE Engine 7.40. It allows remote attackers to execute arbitrary SQL commands via unspecified vectors. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

This vulnerability involves an SQL injection flaw in the UDDI server of SAP NetWeaver J2EE Engine 7.40. Remote attackers can exploit this flaw to execute arbitrary SQL commands, potentially compromising the backend database. The exact attack vectors are unspecified. The vulnerability is tracked as CVE-2016-2386 and has been observed in active exploitation scenarios.

Impact

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the affected SAP NetWeaver system, potentially leading to unauthorized data access, modification, or other database impacts. The vulnerability is considered high severity and has been exploited in the wild, indicating active threat to affected systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should consult SAP security advisories for updates. Until a fix is applied, consider restricting access to the UDDI server component and monitoring for suspicious activity related to SQL injection attempts.

Weaknesses

CWE-89SQL Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 12:05:01 UTC

Weaknesses

References

Related threats