CVE Watch—

CVE-2016-2388

SAP NetWeaver Information Disclosure Vulnerability

CVSS

—

No CVSS

EPSS

52.2%

p99

KEV

YES

Jun 9, 2022

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

51.6%EPSS · 30 days52.2%

2026-09-162026-10-14

KEV catalog record

Product

SAP / NetWeaver

Vulnerability

SAP NetWeaver Information Disclosure Vulnerability

Added to KEV

Jun 9, 2022

Remediate by

Jun 30, 2022

Known ransomware use

Summary description

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2016-2388

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-429999.1 CRI

96.2%

KEV—79SAP NetWeaver Deserialization Vulnerability65d CVE-2025-3132410.0 CRI

99.9%

KEV—80SAP NetWeaver Unrestricted File Upload Vulnerability72d CVE-2020-6287—

99.9%

KEV—80SAP NetWeaver Missing Authentication for Critical Function Vulnerability—CVE-2017-12637—

99.9%

KEV—80SAP NetWeaver Directory Traversal Vulnerability—CVE-2016-2386—

99.4%

KEV—80SAP NetWeaver SQL Injection Vulnerability—CVE-2016-3976—

98.8%

KEV—80SAP NetWeaver Directory Traversal Vulnerability—