CVE-2010-5326

SAP NetWeaver Remote Code Execution

10.0 CRITICALActively exploited (CISA KEV)EPSS 17.8%

Published13 May 2016
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

SAP Netweaver Application Server Java≤ 7.30

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

http://service.sap.com/sap/support/notes/1445998Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326US Government Resource
https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applicationsThird Party Advisory
http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutionsBroken Link
http://www.securityfocus.com/bid/48925Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/90533Third Party AdvisoryVDB Entry
http://www.us-cert.gov/ncas/alerts/TA16-132AThird Party AdvisoryUS Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2010-5326 being actively exploited?

Yes. CVE-2010-5326 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2010-5326?

CVE-2010-5326 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 17.8% probability of exploitation.

Which products are affected by CVE-2010-5326?

Affected products include SAP Netweaver Application Server Java.

How do I fix CVE-2010-5326?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2010-5326 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.