CVE-2026-40128
Awaiting Analysis Awaiting Analysis - Queue
Path Traversal in SAP NetWeaver Application Server Java

Publication date: 2026-06-09

Last updated on: 2026-06-09

Assigner: SAP SE

Description
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-09
Last Modified
2026-06-09
Generated
2026-06-09
AI Q&A
2026-06-09
EPSS Evaluated
N/A
NVD
CVE-2026-40128
EUVD
EUVD-2026-35279
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sap netweaver_application_server_java *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-35 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in SAP NetWeaver Application Server Java (Web Container). It allows an unauthenticated attacker to send a specially crafted HTTP logon request that manipulates file inclusion parameters.

By exploiting this, the attacker can perform path traversal and cause the system to process an included file that was not intended to be accessed.

This can lead to unauthorized viewing or modification of sensitive information or even make parts of the local system unavailable.

Impact Analysis

The impact of this vulnerability is severe as it allows an unauthenticated attacker to:

  • View sensitive information that should be protected.
  • Modify sensitive information, potentially compromising data integrity.
  • Render parts of the local system unavailable, causing denial of service.

Given the CVSS base score of 9.0, this vulnerability poses a high risk and requires urgent attention.

Compliance Impact

The vulnerability in SAP NetWeaver Application Server Java allows an unauthenticated attacker to manipulate file inclusion parameters, potentially leading to unauthorized access or modification of sensitive information. Such unauthorized access or data exposure could result in non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over the confidentiality and integrity of sensitive data.

Specifically, the ability to view or modify sensitive information or disrupt system availability may violate requirements for data security, privacy, and system integrity mandated by these standards.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40128. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart