CVE-2016-9563: SAP NetWeaver AS Java XXE in BC-BMT-BPM-DSK endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is listed in CISA KEV with a high EPSS percentile, but exploitation requires authenticated access and the CVSS impact is limited to confidentiality.

What it is

The BC-BMT-BPM-DSK component in SAP NetWeaver AS Java 7.5 fails to disable XML external entity processing, allowing XXE attacks through the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI. The flaw is tracked as SAP Security Note 2296909 and is listed in CISA's Known Exploited Vulnerabilities catalog, so it warrants attention despite a medium CVSS score.

Impact

An authenticated attacker can read files accessible to the SAP Java process and potentially reach internal network resources via server-side request forgery. The CVSS vector shows high confidentiality impact with no integrity or availability effect.

Attack surface

Reachable over the network through the bpemuwlconn web endpoint; the vector requires low privileges (PR:L) and no user interaction (UI:N). Only remote authenticated users can trigger it.

Exploitation

CVE-2016-9563 is in CISA KEV with a 2021-11-03 addition and a 2022-05-03 remediation due date, and EPSS shows a 30-day probability of 0.238 (97.7th percentile). No public exploit references are tagged in the record, and no ransomware use is documented.

What to do

• Apply the fix per SAP Security Note 2296909; patch NetWeaver AS Java 7.5 to the corrected level.
• If patching is delayed, disable external entity resolution in the XML parser used by the BC-BMT-BPM-DSK component.
• Restrict network access to the bpemuwlconn endpoint to trusted internal clients.
• Review and minimize accounts with access to the affected BPM/DSK functionality.
• Verify the KEV remediation due date is met and track closure.

Detection

• Monitor web logs for requests to sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn with XML bodies containing DOCTYPE or ENTITY declarations.
• Alert on outbound connections from the SAP Java host to unexpected internal or external addresses.
• Audit file access by the SAP Java process for reads of sensitive configuration or system files.
• Correlate authentication events with subsequent requests to the bpemuwlconn URI to spot post-login abuse.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.