CVE-2026-40128
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.45%
- CWE
- CWE-35
- Published
- 2026-06-09
- Last modified
- 2026-06-10
Affected products
- SAP_SE SAP NetWeaver Application Server Java (Web Container)
Weakness type
Related vulnerabilities
- CVE-2026-20513 — In Audio HAL, there is a possible information disclosure due to improper input validation. This...
- CVE-2026-56089 — Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low...
- CVE-2026-59909 — Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low...
- CVE-2026-28157 — WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability
- CVE-2026-69109 — A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The...
- CVE-2026-13716 — Path Traversal: '.../...//' in Crafty Controller
- CVE-2026-59115 — Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
- CVE-2026-66695 — WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability