CVE-2026-40128

CVE Enrichment

CVSS: 9.0 CRITICAL
EPSS: 0.45%
EPSS Percentile: 39.44%
CISA KEV: Not listed

Description

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 09-Jun-2026 08:16
Last Modified: 23-Jul-2026 15:10
EPSS Date: 2026-10-30
CWE: CWE-35

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 31-Oct-2026 18:16
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

CVE-2026-40128 (CVSS score: 9.0) – Directory traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) Fortinet, Ivanti and SAP Patch Critical Vulnerabilities Across Multiple Products
CVE-2026-40128 (CVSS 9.0) – Directory traversal vulnerability in SAP NetWeaver Application Server Java’s Web Container. SAP Patches Critical NetWeaver and Commerce Cloud Flaws
Tracked as CVE-2026-40128 (CVSS score of 9.0), the issue allows unauthenticated attackers to send malicious HTTP logon requests, manipulating file inclusion parameters and allowing the attacker to access sensitive SAP Patches Four Critical Vulnerabilities in NetWeaver, Commerce and Data Hub

CVE (8)

People (1)

Vendors (3)

Products (13)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.