CVE-2026-40128: Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)

Synopsis

A directory traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated remote attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, bypassing path restrictions. The attack requires no credentials and is reachable over the network, though environmental conditions make reliable exploitation harder than average. Successful exploitation gives the attacker the ability to read or modify sensitive files on the host system, or render the system unavailable. No fix version has been published; HarborGuard tracks this advisory and will surface a patched rebuild the moment SAP releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SAP NetWeaver Web Container over the network; the vulnerable HTTP logon endpoint is exposed as a network service.

• AuthenticationNot required

  No credentials are required; the malicious request can be sent by any unauthenticated party who can reach the endpoint.

• Victim interactionNot required

  No user or administrator action is needed to trigger the vulnerability; the attacker interacts directly with the service.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must account on environmental or timing conditions (such as specific server configuration state) to reliably achieve file inclusion; the exploit is not unconditionally reliable.

Blast Radius

• Reads arbitrary files from the local file system accessible to the Java Web Container process, including configuration files, credentials, and keystores.
• Modifies files writable by the Web Container process, enabling tampering with application configuration or injecting malicious content.
• Renders any part of the local system unavailable by corrupting or locking critical files, causing service disruption or a full system outage.
• The scope impact is rated Changed, meaning a successful attacker can affect resources beyond the Web Container itself, reaching other components or services on the same host.