CVE-2026-40128CWE-35

Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)

Critical · published June 9, 2026

CVSS v3.1
9.0
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00626 · 49.3th percentile
Weakness
CWE-35 · Path Traversal: '.../...//'
Published
2026-06-09T00:20Z
EPSS history
Timeline
  • 09 JUN 00:20Z
    Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)
    cvelistv5