ZeroDay Findings
Sign inSign up

Findings

CVE-2021-38163

SAP NetWeaver Unrestricted File Upload Vulnerability

Published Sep 14, 2021 · updated Jun 16, 2026 · sap netweaver

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 14, 2021 · Catalog

    Detected

    SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or

  2. Jun 9, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 30, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or

Required action

Apply updates per vendor instructions.

CISA due date Jun 30, 2022

Affected

  • cpe sap/netweaver7.30
  • cpe sap/netweaver7.31
  • cpe sap/netweaver7.40
  • cpe sap/netweaver7.50
  • vendor SAP NetWeaverversion unspecified

Sources

  • CISA KEVCVE-2021-38163

    SAP NetWeaver contains a vulnerability that allows unrestricted file upload.

    cisa.gov
  • CVE.orgCVE-2021-38163

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-38163

    30-day exploitation probability 36.9%

    first.org
  • NIST NVDCVE-2021-38163

    SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with

    nvd.nist.gov

References

CVE-2021-38163 · ZeroDay Findings