CVE-2016-2388VulnerabilityPublished 06/09/2022Updated 10/24/2026

CVE-2016-2388: SAP NetWeaver Information Disclosure Vulnerability

Affects SAP NetWeaverSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 06/09/2022
KEV deadline: 06/30/2022
EPSS: 52.2% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-2388 (opens in a new tab)

Description

CVE-2016-2388 is a high-severity information disclosure vulnerability in SAP NetWeaver AS JAVA 7.4. It allows remote attackers to obtain sensitive user information by sending a crafted HTTP request to the Universal Worklist Configuration component. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 contains an information disclosure vulnerability (CVE-2016-2388) that permits remote attackers to retrieve sensitive user data via crafted HTTP requests. This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It has been observed to be exploited in the wild, indicating active threat usage. No vendor advisory or patch details are included in the provided information.

Impact

Successful exploitation allows remote attackers to access sensitive user information from SAP NetWeaver AS JAVA 7.4 systems. This could lead to unauthorized disclosure of confidential data, potentially aiding further attacks or data breaches. The vulnerability has been confirmed as exploited in the wild, underscoring its practical risk.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or mitigations are confirmed, organizations should monitor SAP advisories and consider restricting access to the Universal Worklist Configuration interface to trusted users only.

Weaknesses

CWE-200Information Exposure (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 12:04:58 UTC

Weaknesses

References

Related threats