External risk intelligence

SAP NetWeaver Java Web Container Path Traversal Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-40128

The vulnerability resides in the SAP NetWeaver Application Server Java Web Container, which is designed to process HTTP logon requests directly. As a core component for web-based services and identity management, these endpoints are typically exposed to the internet to facilitate user access, making the attack surface public-facing by design in common deployment patterns.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in SAP NetWeaver Application Server Java's Web Container. The issue allows an unauthenticated attacker to potentially access or alter sensitive information, or disrupt system availability by manipulating file inclusion parameters in logon requests. Understanding the potential for unauthorized access and system disruption is key for leadership.

Unauthenticated attackers can exploit file inclusion flaws.
Confirms potential for unauthorized data access or disruption.
Assess relevance and exposure to SAP NetWeaver Java.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by sending a specially crafted HTTP request to the SAP NetWeaver Application Server Java's Web Container. This request manipulates file inclusion parameters, allowing the attacker to traverse directories and include arbitrary files. If successful, this could lead to the viewing or modification of sensitive data, or denial of service.

Unauthenticated network access required.
Malicious HTTP logon request triggers vulnerability.
Sensitive information disclosure or denial of service.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could exploit a path traversal vulnerability in the SAP NetWeaver Application Server Java Web Container by crafting a malicious HTTP logon request. This could allow them to read or modify sensitive information on the local system, or render parts of the system unavailable.

System files and sensitive data.
Via crafted HTTP logon requests.
Unauthorized access and system disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

SAP NetWeaver Application Server Java, specifically its Web Container, is likely managed by platform or infrastructure teams responsible for core SAP services, with network and security teams overseeing external exposure. The first practical step is to identify all instances of the affected technology, assess their reachability and business criticality, and then pinpoint the accountable owner for remediation planning.

Platform/Infrastructure teams own the issue.
Verify instance reachability and business impact.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SAP NetWeaver Application Server Java?

It is a foundational platform used to build, deploy, and run Java-based enterprise applications within the SAP ecosystem. Its Web Container component specifically manages web-based communication, acting as the gateway that processes HTTP requests for users and services. Organizations rely on this technology to host critical business processes and handle identity management tasks across their infrastructure.

How does CVE-2026-40128 function?

This vulnerability is a path traversal flaw (CWE-35). It occurs when the software incorrectly validates input in HTTP logon requests, allowing an attacker to navigate outside intended directories. By manipulating file inclusion parameters, an attacker can trick the server into accessing or processing files that should be restricted, potentially leading to information theft or system instability.

What triggers this vulnerability?

The flaw is triggered when an attacker sends a specially crafted, malicious HTTP logon request to the affected Web Container. Importantly, this requires the attacker to successfully manipulate specific file inclusion parameters within the request. Simply interacting with standard, non-malicious login pages or navigating the site normally does not trigger the vulnerability.

Is my instance at risk?

Halo Surface Signal indicates that because the Web Container is a core component often exposed to the internet to facilitate user access, it is frequently reachable by external actors. If your SAP NetWeaver Application Server Java instances are accessible from the public internet, they are at higher risk. You should evaluate your network architecture to confirm if these specific service endpoints are reachable externally.

How should I respond to this threat?

Start by identifying all instances of SAP NetWeaver Application Server Java in your environment and determining their role and reachability. Once assets are mapped, coordinate with your infrastructure or platform teams to prioritize these systems for remediation. Consult the official SAP security notes linked in this advisory for the authorized patches and configuration guidance to secure your environment.

References

me.sap.com/notes/3727078

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.