CVE-2016-2386: SAP NetWeaver SQL Injection Vulnerability
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
Published Feb 16, 2016 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
References
- https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/
- https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
- https://github.com/vah13/SAP_exploit
- https://www.exploit-db.com/exploits/39840/
- https://www.exploit-db.com/exploits/43495/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More SAP vulnerabilities
All SAP entriesCVE-2025-42999
SAP NetWeaver Deserialization Vulnerability
critical9.1ExploitedMay 13, 2025CVE-2025-31324
SAP NetWeaver Unrestricted File Upload Vulnerability
critical9.8ExploitedApr 24, 2025CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
critical10.0ExploitedFeb 9, 2022CVE-2021-38163
SAP NetWeaver Unrestricted File Upload Vulnerability
high8.8ExploitedSep 14, 2021CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
critical10.0ExploitedJul 14, 2020CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
critical9.8ExploitedMar 10, 2020