{"id":"CVE-2010-5326","kind":"vulnerability","aliases":["CVE-2010-5326"],"related":[],"title":"SAP NetWeaver: SAP NetWeaver Remote Code Execution Vulnerability","description":"The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a \"Detour\" attack.","summary":"SAP NetWeaver Application Server Java has an Invoker Servlet that does not require authentication. An unauthenticated remote attacker can run code on the server by sending a single HTTP or HTTPS request.","severity":"critical","cvss":10.0,"epss":0.1777,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"SAP NetWeaver","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","netweaver","sap","self-hosted","vendor"],"not_affected_if":["no-netweaver-java-stack"],"how_to_check":null,"fix":"Apply the SAP vendor update for the Invoker Servlet issue per SAP instructions; CISA says 'Apply updates per vendor instructions'. Exact patch level: unknown","status":"open","published_at":"2016-05-13T10:59:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:26+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:41:26Z","model":"claude-haiku-5-5","output":{"fix":"Apply the SAP vendor update for the Invoker Servlet issue per SAP instructions; CISA says 'Apply updates per vendor instructions'. Exact patch level: unknown","reach":"internet","impact":"high","summary":"SAP NetWeaver Application Server Java has an Invoker Servlet that does not require authentication. An unauthenticated remote attacker can run code on the server by sending a single HTTP or HTTPS request.","category":"vendor","who_cares":["sap","netweaver","java","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code on the SAP server","analyst_note":"Find SAP's security note for CVE-2010-5326 and the affected Java stack versions; the sources give no version or check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-netweaver-java-stack"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000465,"input_tokens":2838,"output_tokens":362,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find SAP's security note for CVE-2010-5326 and the affected Java stack versions; the sources give no version or check command.","search":"'-2010':10A,13A '-5326':11A,14A '2013':94C '2016':96C '7.3':69C 'aka':97C 'allow':75C 'applic':27B,63C 'arbitrari':80C 'attack':42B,77C,100C 'authent':38B,73C 'code':6A,45B,81C 'cve':9A,12A 'detour':99C 'execut':7A,79C 'exploit':17B,89C 'host':23B 'http':53B,84C 'https':55B,86C 'invok':32B,58C 'java':18B,29B,65C 'netweav':2A,4A,19B,26B,62C 'netweaver':16A 'platform':66C 'possibl':67C 'remot':5A,41B,76C 'request':56B,87C 'requir':37B,72C 'run':44B 'sap':1A,3A,15A,20B,25B,61C 'self':22B 'self-host':21B 'send':50B 'server':28B,48B,64C 'servlet':33B,59C 'singl':52B 'unauthent':40B 'vendor':24B 'via':82C 'vulner':8A 'wild':92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-05-13T10:59:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2010-5326","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-5326","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2010-5326","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-5326","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2010-5326","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-5326","severity":null,"published_at":"2016-05-13T10:59:00+00:00","modified_at":"2026-06-16T23:26:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}