What is the CVSS score of CVE-2010-5326?

CVE-2010-5326 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 16.9%.

Which versions of SAP NetWeaver Application Server Java are affected by CVE-2010-5326?

SAP NetWeaver Application Server Java versions prior to 7.3 contain a critical remote code execution vulnerability (CVE-2010-5326) that allows unauthenticated attackers to execute arbitrary code and…

Is there a public PoC exploit available for CVE-2010-5326?

Yes, a public proof-of-concept exploit is available for CVE-2010-5326. Prioritise patching immediately. EPSS: 16.9%.

How to fix or mitigate CVE-2010-5326?

Within 24 hours: Identify all SAP NetWeaver Application Server Java instances in your environment and document their versions; immediately restrict network access to the Invoker Servlet endpoint. Within 7 days: Prioritize upgrading all affected instances to SAP NetWeaver 7.3 or later, or migrate critical applications to supported SAP versions; implement network segmentation to limit exposure of these systems. Within 30 days: Complete all upgrades or decommissioning of pre-7.3 NetWeaver Java instances; conduct forensic analysis of affected systems for signs of compromise during the 2013-2016 attack window and beyond.

SAP NetWeaver Application Server Java CVE-2010-5326

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2016-05-13 cve@mitre.org

Authentication Bypass RCE Java SAP

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 21, 2026 - 15:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Mar 26, 2026 - 11:17 vuln.today

Added to CISA KEV

Oct 22, 2025 - 00:15 cisa

CISA KEV

CVE Published

May 13, 2016 - 10:59 nvd

CRITICAL 10.0

DescriptionCVE.org

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

AnalysisAI

Remote unauthenticated code execution in SAP NetWeaver Application Server Java (pre-7.3) through the Invoker Servlet allows attackers to bypass authentication and execute arbitrary code. Confirmed actively exploited (CISA KEV) from 2013 through 2016 in 'Detour' attacks targeting SAP business applications. CVSS 10.0 with EPSS 16.90% (95th percentile) indicates both maximum theoretical severity and sustained real-world exploitation. This remains a critical priority for organizations running legacy SAP NetWeaver Java instances despite the vulnerability's age.

Technical ContextAI

The Invoker Servlet is a built-in component of SAP NetWeaver Application Server Java that provides dynamic servlet invocation capabilities. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), where the Invoker Servlet endpoint accepts HTTP/HTTPS requests without requiring authentication credentials. SAP NetWeaver Application Server Java is the runtime platform for SAP's enterprise applications including ERP, CRM, and SCM solutions. The affected component allows arbitrary servlet class invocation through specially crafted URLs, effectively creating an authentication bypass path into the Java application server. This architectural flaw exists in versions prior to 7.3, though the exact version range affected is documented in SAP Note 1445998.

RemediationAI

Apply SAP Security Note 1445998 immediately, which provides patches and configuration guidance to disable or properly secure the Invoker Servlet component. Upgrade SAP NetWeaver Application Server Java to version 7.3 or later where the vulnerability is resolved. If immediate patching is impossible, implement emergency compensating controls: disable the Invoker Servlet entirely through Java EE configuration if not required for business operations (note: this may break applications relying on dynamic servlet invocation); restrict network access to NetWeaver Java HTTP/HTTPS ports (typically 50000, 50001) to authorized management networks only using firewall rules or network segmentation (trade-off: impacts legitimate remote access); deploy web application firewall (WAF) rules to block HTTP requests matching Invoker Servlet URL patterns (trade-off: requires pattern maintenance and may be bypassed). Consult Onapsis research documentation at http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions and US-CERT Alert TA16-132A at http://www.us-cert.gov/ncas/alerts/TA16-132A for additional hardening guidance. Prioritize systems processing sensitive business data or connected to financial/HR systems.