---
id: "CVE-2010-5326"
kind: "vulnerability"
aliases: ["CVE-2010-5326"]
title: "SAP NetWeaver: SAP NetWeaver Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.1777
exploited: true
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "netweaver", "sap", "self-hosted", "vendor"]
not_affected_if: ["no-netweaver-java-stack"]
published_at: "2016-05-13T10:59:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-5326", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-5326", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5326", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# SAP NetWeaver: SAP NetWeaver Remote Code Execution Vulnerability

SAP NetWeaver Application Server Java has an Invoker Servlet that does not require authentication. An unauthenticated remote attacker can run code on the server by sending a single HTTP or HTTPS request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver affected ? fixed ?

## Fix

Apply the SAP vendor update for the Invoker Servlet issue per SAP instructions; CISA says 'Apply updates per vendor instructions'. Exact patch level: unknown

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-5326
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2010-5326
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2010-5326

## From the sources

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_