---
id: "CVE-2016-2388"
kind: "vulnerability"
aliases: ["CVE-2016-2388"]
title: "sap netweaver application server java: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user\u2026"
severity: "medium"
cvss: 5.3
epss: 0.52206
exploited: true
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "sap netweaver application server java", "fixed": [], "affected": ">= 7.10, <= 7.50", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "netweaver", "sap", "vendor"]
not_affected_if: ["unknown"]
published_at: "2016-02-16T15:59:02+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-2388", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-2388", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2388", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# sap netweaver application server java: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user…

SAP NetWeaver AS Java 7.4 exposes sensitive user information through its Universal Worklist Configuration when sent a crafted HTTP request. An unauthenticated remote attacker can read that user data without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver affected ? fixed ?
- vendor:sap netweaver application server java affected >= 7.10, <= 7.50 fixed ?

## Fix

Apply the SAP update for the Universal Worklist Configuration component per vendor instructions (CISA KEV required action).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-2388
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-2388
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-2388

## From the sources

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_