CVE-2026-40128
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to manipulate parameters in an HTTP logon request, enabling path traversal and processing of the included file. This can lead to reading, modifying, or denying access to data.
Risk Assessment
An attacker can access sensitive data, modify it, or cause system unavailability, threatening confidentiality, integrity, and availability.
Recommendation
Apply the patch from SAP. Restrict access to the Web Container and implement input validation.
Original NVD description (English source)
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.