CVE Watch—

CVE-2016-2386

SAP NetWeaver SQL Injection Vulnerability

CVSS

—

No CVSS

EPSS

71.5%

p99

KEV

YES

Jun 9, 2022

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

71.1%EPSS · 30 days71.5%

2026-09-162026-10-14

KEV catalog record

Product

SAP / NetWeaver

Vulnerability

SAP NetWeaver SQL Injection Vulnerability

Added to KEV

Jun 9, 2022

Remediate by

Jun 30, 2022

Known ransomware use

Summary description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2016-2386

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-429999.1 CRI

96.2%

KEV—79SAP NetWeaver Deserialization Vulnerability65d CVE-2025-3132410.0 CRI

99.9%

KEV—80SAP NetWeaver Unrestricted File Upload Vulnerability72d CVE-2020-6287—

99.9%

KEV—80SAP NetWeaver Missing Authentication for Critical Function Vulnerability—CVE-2017-12637—

99.9%

KEV—80SAP NetWeaver Directory Traversal Vulnerability—CVE-2016-2388—

98.9%

KEV—80SAP NetWeaver Information Disclosure Vulnerability—CVE-2016-3976—

98.8%

KEV—80SAP NetWeaver Directory Traversal Vulnerability—