What is the CVSS score of CVE-2026-40128?

CVE-2026-40128 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of SAP NetWeaver AS Java are affected by CVE-2026-40128?

SAP NetWeaver Application Server Java contains a critical path traversal vulnerability (CVE-2026-40128, CVSS 9.0) allowing unauthenticated remote attackers to access or modify sensitive files,…

How to fix or mitigate CVE-2026-40128?

24 hours: Identify and inventory all SAP NetWeaver Application Server Java instances; determine network reachability and business criticality; brief SAP administrators and security leadership. 7 days: Implement network segmentation to restrict NetWeaver access to minimal required users and systems; deploy Web Application Firewall rules targeting path traversal payloads (../, ..\, etc.); establish comprehensive audit logging of HTTP logon requests. 30 days: Monitor SAP security advisories and CISA advisories for patch releases; establish direct SAP support engagement for version-specific interim guidance; develop timeline for version upgrades or architectural remediation.

SAP NetWeaver AS Java CVE-2026-40128

EUVD-2026-35279 CRITICAL

Path Traversal: '.../...//' (CWE-35)

2026-06-09 cna@sap.com

GHSA-xgpc-r53m-pqc6

Path Traversal SAP Java

9.0

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (sap) · only source for this CVE.

CVSS VectorVendor: sap

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 01:31 vuln.today

CVE Published

Jun 09, 2026 - 01:16 nvd

CRITICAL 9.0

DescriptionCVE.org

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

Articles & Coverage 3

News 9 New Java Vulnerabilities - 1 Critical, 8 High Severity Jun 10, 2026 News 3 Critical SAP Vulnerabilities Disclosed - No Public Exploits Yet Jun 10, 2026 News Critical Path Traversal in SAP NetWeaver AS Java Web Container - CVE-2026-40128 Jun 09, 2026

AnalysisAI

Path traversal in SAP NetWeaver Application Server Java's Web Container allows unauthenticated remote attackers to manipulate file inclusion parameters within crafted HTTP logon requests, leading to inclusion and processing of arbitrary local files. Successful exploitation can expose or modify sensitive data and render portions of the server unavailable, with no public exploit identified at time of analysis but a CVSS of 9.0 reflecting full CIA impact with scope change.

Technical ContextAI

SAP NetWeaver AS Java is the J2EE-based runtime that underpins many enterprise SAP applications (Portal, PI/PO, Solution Manager, etc.); the Web Container component handles HTTP request dispatching including the logon flow. The root cause maps to CWE-35 (Path Traversal: '.../...//'), where the logon endpoint accepts a parameter intended to reference an internal resource but does not adequately normalize traversal sequences before performing a file include. Because the include is processed (not merely read), the engine may render or interpret the targeted file, which is what produces the integrity and availability impact beyond simple disclosure.

RemediationAI

Patch available per vendor advisory - apply the fix delivered in SAP Security Note 3727078 (https://me.sap.com/notes/3727078) at the next maintenance window, cross-referenced via the SAP Security Patch Day portal at https://url.sap/sapsecuritypatchday for the corresponding Support Package or kernel patch matching your NetWeaver AS Java release. Until patching is complete, restrict network exposure of the AS Java logon endpoints by placing the system behind a WAF or SAP Web Dispatcher with rules that strip or reject requests containing traversal sequences (../, ..\, encoded variants %2e%2e%2f) on logon URLs, and limit inbound access to trusted networks via firewall ACLs; note that WAF filtering can break legitimate Unicode-bearing logon payloads and should be tested in non-production first. Increase monitoring on the Web Container access log for anomalous logon request parameters and unexpected file references, and verify backups of AS Java configuration and filesystem state given the integrity impact.