CVE-2016-2386

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/May/56Exploit, Mailing List, Third Party Advisory
https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/Broken Link, Third Party Advisory
https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/Broken Link, Third Party Advisory
https://github.com/vah13/SAP_exploitExploit, Third Party Advisory
https://www.exploit-db.com/exploits/39840/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/43495/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/May/56Exploit, Mailing List, Third Party Advisory
https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/Broken Link, Third Party Advisory
https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/Broken Link, Third Party Advisory
https://github.com/vah13/SAP_exploitExploit, Third Party Advisory
https://www.exploit-db.com/exploits/39840/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/43495/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386US Government Resource

Timeline

Published: Feb 16, 2016
Last modified: Jun 17, 2026
Added to CISA KEV: Jun 9, 2022
NVD status: Analyzed

Related CVEs from 2016

CVE-2016-23876.1Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attacker CVE-2016-23885.3The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted CVE-2016-23897.5Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 fo CVE-2016-23905.9The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake err CVE-2016-23915.0The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a de CVE-2016-23926.5The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuratio CVE-2016-23937.8Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, whi CVE-2016-23969.9The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remo CVE-2016-23979.8The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers CVE-2016-23986.5Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to d CVE-2016-23997.8Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of servic CVE-2016-24025.9OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain wit