CVE-2016-9563VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2016-9563: SAP NetWeaver XML External Entity (XXE) Vulnerability

Affects SAP NetWeaverSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 24.2% chance of exploitation in 30 days – higher than 97% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2016-9563 (opens in a new tab)

Description

CVE-2016-9563 is an XML External Entity (XXE) vulnerability in SAP NetWeaver Application Server Java Platforms, specifically in the BC-BMT-BPM-DSK component. It allows remote, authenticated users to perform XXE attacks. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Summary

The vulnerability CVE-2016-9563 affects SAP NetWeaver Application Server Java Platforms in the BC-BMT-BPM-DSK component. It is an XML External Entity (XXE) vulnerability that permits remote, authenticated attackers to exploit XML parsing to potentially access or manipulate internal resources. The exact nature of the vulnerability is unspecified beyond the XXE classification. Exploitation requires authentication. The vulnerability has been observed in the wild, indicating active exploitation. No vendor advisory or patch information is provided in the input data.

Impact

Remote, authenticated attackers can exploit this XXE vulnerability to potentially access sensitive internal files or services, leading to information disclosure or other impacts typical of XXE flaws. The presence of known exploitation in the wild increases the risk to affected systems. The exact impact details are unspecified.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of official fixes, restrict access to the affected SAP NetWeaver components to trusted users only and monitor for suspicious activity related to XML processing.

Weaknesses

CWE-611XML External Entity (XXE) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:56:02 UTC

Weaknesses

References

Related threats