CVE-2016-2386: SAP NetWeaver UDDI Server SQL Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote SQL injection with a 9.8 CVSS score, CISA KEV listing, and very high EPSS probability makes this an urgent patch target.

What it is

The UDDI server in SAP NetWeaver J2EE Engine 7.40 is vulnerable to SQL injection through unspecified vectors, allowing arbitrary SQL command execution. The flaw is remotely reachable without authentication and carries a critical CVSS score of 9.8, making it a high-value target for initial access.

Impact

An unauthenticated remote attacker can execute arbitrary SQL commands against the underlying database, potentially reading, modifying, or deleting data and, depending on database privileges, escalating to broader system compromise.

Attack surface

Reachable over the network via the UDDI server component of the J2EE Engine; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required.

Exploitation

CVE-2016-2386 is listed in CISA KEV (added 2022-06-09) and has a 30-day EPSS probability of 0.7106 (99.37th percentile); multiple public exploit references are tagged, indicating active exploitation and widely available proof-of-concept code.

What to do

• Apply the fix per SAP Security Note 2101079 and the vendor update referenced in CISA KEV.
• Restrict network access to the UDDI server and J2EE Engine management interfaces to trusted hosts only.
• Run the affected database and application with least-privilege accounts to limit SQL injection impact.
• Monitor SAP security notes and apply subsequent NetWeaver J2EE patches promptly.
• If patching is delayed, consider disabling or isolating the UDDI service if it is not required.

Detection

• Inspect UDDI server and J2EE Engine HTTP logs for SQL metacharacters, UNION, or stacked query patterns in request parameters.
• Alert on anomalous database queries or errors originating from the SAP application server.
• Monitor for outbound connections or process behavior consistent with post-exploitation following SQL injection.
• Use the public exploit references to build signatures for known UDDI SQL injection payloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.