CVE-2016-2386

Timeline

Detection, updates, and resolution for this record.

1. Feb 16, 2016 · Catalog

   Detected

   SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

2. Jun 9, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jun 30, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

Affected

• cpe sap/netweaver application server java7.40
• vendor SAP NetWeaverversion unspecified

Sources

• CISA KEVCVE-2016-2386

  SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  cisa.gov
• CVE.orgCVE-2016-2386

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2016-2386

  30-day exploitation probability 71.5%

  first.org
• Exploit Database39840

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• Exploit Database43495

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• NIST NVDCVE-2016-2386

  SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

  nvd.nist.gov

References

• Exploit · packetstormsecurity.com
• Exploit · seclists.org
• Broken Link · erpscan.io
• Broken Link · erpscan.io
• Exploit · github.com
• CISA note · nvd.nist.gov
• Exploit · exploit-db.com
• Exploit · exploit-db.com