CVE-2017-12637: SAP NetWeaver Java directory traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is remotely exploitable without authentication, has confirmed in-the-wild exploitation, is in CISA KEV, and has an EPSS score above the 99th percentile.

What it is

SAP NetWeaver Application Server Java 7.5 contains a directory traversal flaw in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. A remote attacker can place a .. (dot dot) sequence in the query string to read arbitrary files from the server. The vulnerability was exploited in the wild in August 2017 and is tracked as SAP Security Note 2486657.

Impact

An unauthenticated remote attacker can read arbitrary files on the affected server, exposing configuration, credentials, and other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

The flaw is reachable over the network via HTTP requests to the affected SAP NetWeaver Java component, with no authentication or user interaction required (CVSS AV:N/PR:N/UI:N).

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2025-03-19, and the description states it was exploited in the wild in August 2017. EPSS gives a 30-day exploitation probability of 0.95111 (99.86th percentile), indicating very high likelihood of attempted exploitation.

What to do

• Apply the fix from SAP Security Note 2486657 as soon as possible.
• If patching is not immediately possible, follow CISA BOD 22-01 guidance for cloud services or discontinue use of the affected product.
• Restrict network access to the SAP NetWeaver Java scheduler UI paths to trusted sources only.
• Monitor for and block HTTP requests containing traversal sequences such as ../ in query strings to the affected component.

Detection

• Inspect web server and SAP logs for requests to scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS containing ../ or encoded traversal sequences.
• Alert on HTTP responses returning file contents or unusual file paths from the affected endpoint.
• Correlate outbound or internal access to sensitive files with requests to the vulnerable scheduler UI path.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.