CVE-2010-5326
KEVSAP NetWeaver Remote Code Execution Vulnerability
Description
SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HPublishedMay 13, 2016
Last modifiedJun 16, 2026
Added to KEVNov 3, 2021
Remediation dueMay 3, 2022
References
- service.sap.com/sap/support/notes/1445998Permissions Required
- onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutionsBroken Link
- securityfocus.com/bid/48925Third Party AdvisoryVDB Entry
- securityfocus.com/bid/90533Third Party AdvisoryVDB Entry
- us-cert.gov/ncas/alerts/TA16-132AThird Party AdvisoryUS Government Resource
- onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applicationsThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326US Government Resource
0 recent articles mention this CVE
82
Risk assessment · Critical
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1638 days
- CVSS
- 10.0 CRITICAL
- EPSS (30-day exploit probability)
- 17.8% · top 3% of all CVEs
- Weakness
- NVD-CWE-noinfo
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.