SAP_SE SAP NetWeaver Application Server Java (Web Container) vulnerabilities

Latest SAP_SE SAP NetWeaver Application Server Java (Web Container) CVEs

Newest publication first

1. CVE-2026-40128 Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)

   Published 2026-06-09

   Critical·CVSS 9.0 EPSS 0.45%

   SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.