CVE-2010-5326

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

CVSS v3.1 NVD

10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

17.77% chance of exploitation in the next 30 days, 97th percentile

CISA KEV

added 2021-11-03

Published

2016-05-13

Updated

2025-10-21

Proof-of-concept exploits (1)

• https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-bus…

Security advisories

• http://www.securityfocus.com/bid/48925
• http://www.securityfocus.com/bid/90533
• http://www.us-cert.gov/ncas/alerts/TA16-132A

References

• CVE Record
• NVD entry