PT-2026-47530 · Sap Se · Sap Netweaver Application Server Java

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-40128

NVD

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

Fix

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2026-40128

Affected Products

Sap Netweaver Application Server Java

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40128 · Security Note
• https://me.sap.com/notes/3727078 · Note
• https://url.sap/sapsecuritypatchday · Note