CVE-2016-2388: SAP NetWeaver Information Disclosure Vulnerability

Medium severity, CVSS 5.3. Actively exploited: in CISA KEV since 2022-06-09. EPSS: 52.2% chance of exploitation in the next 30 days.

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

Affected products

• SAP NetWeaver Application Server Java: from 7.10, up to and including 7.50

Published 2016-02-16. Last modified 2026-06-17.