{"id":"CVE-2010-5326","published":"2016-05-13T10:59:00Z","modified":"2026-06-16T23:26:33Z","title":"SAP NetWeaver Remote Code Execution Vulnerability","vendor":"SAP","product":"NetWeaver","tier":"core","eol":null,"description":{"text":"The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a \"Detour\" attack.","provenance":"source","from":"NVD"},"summary":{"text":"The Invoker Servlet in SAP NetWeaver Application Server Java is the flaw, a missing-authentication weakness in the component that handles requests to that servlet. An attacker who can send an HTTP or HTTPS request to the server can execute arbitrary code without authenticating, and no user interaction or special configuration is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-11-01T01:03:49Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.1777,"percentile":0.97164,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-5326","provenance":"source"},"vulncheckKev":{"dateAdded":"2016-05-13","exploitedFirstSeen":"2016-05-13","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2010-5326","date":"2016-05-13"},{"url":"https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf","date":"2021-01-05"},{"url":"https://digital.nhs.uk/cyber-alerts/2021/cc-3815","date":"2021-04-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://www.csoonline.com/article/3674119/most-common-sap-vulnerabilities-attackers-try-to-exploit.html","date":"2022-09-20"},{"url":"https://www.csoonline.com/article/2092336/sap-users-are-at-high-risk-as-hackers-exploit-application-vulnerabilities.html","date":"2024-04-17"},{"url":"https://go.onapsis.com/c2-incident-on-sap-report","date":"2024-08-21"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Nov 1, 2026","url":"https://otx.alienvault.com/pulse/6ae6007740c10de9f3c0173d","created":"2026-10-31"},{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"http://service.sap.com/sap/support/notes/1445998","tags":["Permissions Required"]},{"url":"http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/48925","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/90533","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA16-132A","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications","tags":["Third Party Advisory"]},{"url":"http://service.sap.com/sap/support/notes/1445998","tags":["Permissions Required"]},{"url":"http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/48925","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/90533","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA16-132A","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Unauthenticated HTTP requests to exposed servlet","mappingType":"uncategorized","evidence":[{"from":"description","quote":"does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request","start":93,"end":210}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary code execution on application server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via an HTTP or HTTPS request","start":132,"end":210}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2010-5284","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-5284","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2016-05-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-5326","provenance":"source"},{"date":"2016-05-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2010-5326","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2010-5284","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":2000},"priority":{"score":64.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3824 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.43,"detail":"percentile 0.9716"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}