CVE-2016-9563
SAP NetWeaver XML External Entity (XXE) Vulnerability
Published Nov 22, 2016 · updated Jun 16, 2026 · sap netweaver application server java
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
Timeline
Detection, updates, and resolution for this record.
Nov 22, 2016 · Catalog
Detected
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe sap/netweaver application server java7.50
- vendor SAP NetWeaverversion unspecified
Sources
- CISA KEVCVE-2016-9563
SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.
cisa.gov - CVE.orgCVE-2016-9563
Official CVE identifier
cve.org - FIRST EPSSCVE-2016-9563
30-day exploitation probability 24.2%
first.org - NIST NVDCVE-2016-9563
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
nvd.nist.gov