CVE-2016-3976VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2016-3976: SAP NetWeaver Directory Traversal Vulnerability

Affects SAP NetWeaverSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 47.3% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-3976 (opens in a new tab)

Description

CVE-2016-3976 is a directory traversal vulnerability in SAP NetWeaver Application Server Java Platforms. It occurs via the fileName parameter to the CrashFileDownloadServlet, allowing remote attackers to read arbitrary files on the server. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

The SAP NetWeaver Application Server Java Platforms contain a directory traversal vulnerability identified as CVE-2016-3976. The flaw exists in the CrashFileDownloadServlet component, where the fileName parameter improperly handles input containing '..\' sequences, enabling attackers to traverse directories and read files outside the intended directory scope. This vulnerability has been confirmed to be exploited in the wild. No vendor advisory or patch information is provided in the input data.

Impact

Exploitation of this vulnerability allows remote attackers to read arbitrary files on the affected SAP NetWeaver server, potentially exposing sensitive information. The vulnerability is known to be exploited in the wild, indicating active threat. The exact scope of impact depends on the files accessible and the server's configuration.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the CrashFileDownloadServlet and monitor for suspicious activity related to file download requests. Avoid exposing the vulnerable service to untrusted networks.

Weaknesses

CWE-22Path Traversal (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:55:54 UTC

Weaknesses

References

Related threats