---
id: "CVE-2016-2386"
kind: "vulnerability"
aliases: ["CVE-2016-2386"]
title: "sap netweaver application server java: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute\u2026"
severity: "critical"
cvss: 9.8
epss: 0.71522
exploited: true
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "sap netweaver application server java", "fixed": [], "affected": "= 7.40", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "netweaver", "sap", "vendor"]
not_affected_if: ["no-uddi-server-deployed"]
published_at: "2016-02-16T15:59:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-2386", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2386", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2386", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# sap netweaver application server java: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute…

SAP NetWeaver J2EE Engine 7.40 has an SQL injection flaw in its UDDI server component. A remote attacker can run arbitrary SQL commands against the database through unspecified inputs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver affected ? fixed ?
- vendor:sap netweaver application server java affected = 7.40 fixed ?

## Fix

Apply the SAP security updates for NetWeaver per vendor instructions, as CISA requires; the specific patch is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-2386
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-2386
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-2386

## From the sources

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_