CVE-2016-3976: SAP NetWeaver AS Java directory traversal in CrashFileDownloadServlet

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw is remotely exploitable without authentication, has public exploit code, and is listed in CISA KEV with a high EPSS score, making it a high-value target for immediate remediation.

What it is

SAP NetWeaver Application Server Java 7.1 through 7.5 contains a directory traversal flaw in the fileName parameter of CrashFileDownloadServlet. A remote attacker can supply a dot-dot-backslash sequence to read arbitrary files from the server. Because the servlet is reachable over the network without credentials, the flaw exposes sensitive files on the SAP host.

Impact

An unauthenticated attacker can read arbitrary files accessible to the SAP Java process, potentially exposing configuration, credential stores, and other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP requests to CrashFileDownloadServlet with a crafted fileName parameter; the CVSS vector shows no privileges or user interaction required. No authentication is needed.

Exploitation

CVE-2016-3976 is listed in CISA KEV with a due date of 2022-05-03, and public exploit references exist (Packet Storm, Exploit-DB, Full Disclosure). EPSS shows a 30-day probability of 0.46605 (98.8th percentile), indicating high likelihood of exploitation activity.

What to do

• Apply the SAP Security Note 2234971 update or the vendor-provided patch for NetWeaver AS Java 7.1 through 7.5.
• If patching is not immediately possible, restrict network access to CrashFileDownloadServlet and the SAP Java HTTP/HTTPS ports to trusted management networks.
• Validate and sanitize the fileName parameter to reject path traversal sequences, or disable the CrashFileDownloadServlet if it is not required.
• Run the SAP Java process with least privilege and ensure it cannot read sensitive OS files outside its required directories.
• Monitor SAP security notes and CISA KEV for updated guidance and confirm remediation status.

Detection

• Inspect HTTP access and application logs for requests to CrashFileDownloadServlet containing '..\' or encoded traversal sequences in the fileName parameter.
• Alert on outbound or local file reads by the SAP Java process that access paths outside expected application directories.
• Correlate unusual file download responses from SAP NetWeaver AS Java with source IPs not normally seen in the environment.
• Use file integrity monitoring on sensitive SAP configuration and credential files to detect unexpected read access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.