CVE-2016-9563: SAP NetWeaver XML External Entity (XXE) Vulnerability
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
Published Nov 23, 2016 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More SAP vulnerabilities
All SAP entriesCVE-2025-42999
SAP NetWeaver Deserialization Vulnerability
critical9.1ExploitedMay 13, 2025CVE-2025-31324
SAP NetWeaver Unrestricted File Upload Vulnerability
critical9.8ExploitedApr 24, 2025CVE-2022-22536
SAP Multiple Products HTTP Request Smuggling Vulnerability
critical10.0ExploitedFeb 9, 2022CVE-2021-38163
SAP NetWeaver Unrestricted File Upload Vulnerability
high8.8ExploitedSep 14, 2021CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
critical10.0ExploitedJul 14, 2020CVE-2020-6207
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
critical9.8ExploitedMar 10, 2020