CVE-2026-40128 CRITICAL

CVE-2026-40128: Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)

Vendor Sap_Se
Product SAP NetWeaver Application Server Java (Web Container)
Weakness CWE-35
Published June 9, 2026
Last update June 10, 2026

CVSS base score

9.0/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

Description

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

Key dates

Disclosure timeline

June 9, 2026 CVE published
June 10, 2026 Record updated