VulnSocial

CVE-2026-40128Patch

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-35

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 6 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 5 signals
  • Technical details provided in 4 signals
  • General: 1 classified signal
  • Peaked 2d ago at 4 mentions (2026-06-09); latest day: 1
  • 6 total mentions across 3 days

Deep dive

Activity timeline6 mentions / 3d
01234Mentions · 2026-06-09: 4Mentions · 2026-07-01: 1Mentions · 2026-07-14: 1Patch / Workaround · 2026-06-09: 4Patch / Workaround · 2026-07-14: 1Technical Details · 2026-06-09: 3Technical Details · 2026-07-14: 106-0907-0107-14
Signal classification2 categories
Patch
583.3%
General
116.7%
Referenced assets7 URLs
Classification over time
DateTotalLabels
2026-06-094
Patch4
2026-07-011
General1
2026-07-141
Patch1
Full discourse6 posts
  • にゃん☆たく/takumi.a@taku888infinity
    Patch

    今日のパッチチューズデー（MS一旦割愛） ◆Ivanti（クリティカルなし） CVE-2026-14903　Xtractionのパストラバーサルで任意ファイル読取 https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-CVE-2026-14902-CVE-2026-14903?l… ◆Fortinet（クリティカルなし） CVE-2025-53379　FortiAuthenticator GUIの境界外読取り CVE-2026-59835　FortiSandboxのVNC無認証アクセス https://www.fortiguard.com/psirt?filter=1&version=&severity=5&severity=4&severity=3&severity=2 ◆SAP CVE-2026-44747　NetWeaver ABAPのメモリ破損で任意コード実行恐れ CVE-2026-27690　SAP ApprouterのHTTPリクエストスマグリング CVE-2026-44761　Commerce Cloudのサンプル認証情報が残存 CVE-2026-40128　NetWeaver Javaのディレクトリトラバーサル https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2026.html ◆Adobe（今日多すぎ） Adobe ColdFusion（APSB26-82） CVE-2026-48318：パストラバーサルによる任意コード実行  CVE-2026-48322：コードインジェクションによる任意コード実行 CVE-2026-48284：入力検証不備による任意コード実行 CVE-2026-48321：認可不備による権限昇格 CVE-2026-48325：認証不備による任意コード実行  CVE-2026-48319：パストラバーサルによる任意コード実行  CVE-2026-48324：SQLインジェクションによる任意コード実行  CVE-2026-48327：認可不備による任意コード実行 CVE-2026-48320：反射型XSSによる権限昇格  CVE-2026-48328：入力検証不備による保護機能回避  CVE-2026-48332：SSRFによる保護機能回避  CVE-2026-48338：パストラバーサルによる任意ファイル読取 Adobe Commerce（APSB26-73） CVE-2026-48356：危険ファイルアップロードによる権限昇格 CVE-2026-48358：出力処理不備による任意コード実行 CVE-2026-47994：格納型XSSによる権限昇格 CVE-2026-47988：認可不備による保護機能回避 CVE-2026-47984：認可不備による保護機能回避 CVE-2026-47995：B2B機能の格納型XSSによる権限昇格 CVE-2026-47996：認可不備による保護機能回避 CVE-2026-47992：入力検証不備による権限昇格 Adobe Experience Manager（APSB26-74） CVE-2026-48259：SSRFによる任意コード実行 CVE-2026-48359：XXEによる任意コード実行 CVE-2026-48252：認証不備による保護機能回避 CVE-2026-48310：パストラバーサルによる任意読取 https://helpx.adobe.com/security.html

    Post summary

    The tweet summarizes recent vendor security advisories, listing CVEs with technical details and providing official patch links, with no evidence of active exploitation or PoC exposure.

    000421.6K
    11.8K followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: #SAP has released security updates for 15 vulnerabilities in several of their products, including 4 critical vulnerabilities: #CVE-2026-44748; #CVE-2026-27671; #CVE-2026-40128 and #CVE-2026-22732. Read our advisory here: https://ccb.belgium.be/advisories/warning-sap-addresses-critical-vulnerabilities-affecting-multiple-sap-products-patch #Patch #Patch #Patch

    Post summary

    SAP has issued security updates for 15 vulnerabilities, including four critical CVEs, but no exploits or active attacks are reported in the advisory.

    02000141
    7.2K followersView on X
  • CyberAlertsHQ@CyberAlertsHQ
    Patch

    🚨 NEW: SAP June Patch Day — 4 critical flaws, top CVSS 9.9. The worst: CVE-2026-44748 lets a low-privileged user forge SAML assertions and bypass authentication entirely on NetWeaver ABAP. CVE-2026-27671 (CVSS 9.8) is unauthenticated memory corruption via crafted RFC requests — potential RCE with no workaround, kernel update required. Also critical: CVE-2026-40128 (CVSS 9.0) unauthenticated directory traversal on NetWeaver Java, and CVE-2026-22732 (CVSS 9.1) unauthenticated Spring Security bypass in Commerce Cloud. SAP runs the back-end of most of the world's largest enterprises. No in-the-wild exploitation confirmed yet — patch now before that changes. Full breakdown 👇 https://www.bleepingcomputer.com/news/security/sap-fixes-critical-flaws-in-netweaver-and-commerce-cloud/

    Post summary

    SAP released a patch day for four critical CVEs with high CVSS scores, urging immediate application of patches; no active exploitation has been reported.

    1000084
    77 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - Two SAP NetWeaver Flaws Patched in June 2026 (CVE-2026-44748, CVE-2026-40128) SAP's June 2026 Security Patch Day fixes two critical SAP NetWeaver vulnerabilities, both with a scope change and full C/I/A impact. CVE-2026-44748 (9.9) - AS ABAP and ABAP Platform: an Improper Verification of Cryptographic Signature flaw (CWE-347). An authenticated attacker with normal privileges can take a valid signed message, tamper with the signed XML, and have the verifier accept forged identity information, leading to unauthorized access to sensitive data. CVE-2026-40128 (9.0) - AS Java Web Container: a path traversal / file inclusion flaw (CWE-35). An unauthenticated attacker sends a crafted HTTP logon request that manipulates file inclusion parameters to escape the intended directory and process an arbitrary local file, leading to disclosure or modification of sensitive data or DoS. Neither has a public PoC yet, but both are network-reachable and one needs no authentication at all. 👉Apply SAP Security Notes 3746332 and 3727078 (SAP June 2026 Security Patch Day).

    Post summary

    The text announces the June 2026 SAP NetWeaver security patch for CVE‑2026‑44748 and CVE‑2026‑40128, providing technical details and directing users to apply specific SAP security notes.

    00010150
    210 followersView on X
  • Orizon@OrizonCyber
    Patch

    🚨 CVE-2026-40128 — CVSS 9/10 █████████░ SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/UuRC9R35Aj

    Post summary

    The tweet announces a critical vulnerability (CVE‑2026‑40128) in SAP NetWeaver, notes a CVSS 9/10 score and unauthenticated HTTP exploitation, and urges immediate patching.

    1000089
    59 followersView on X
  • IntegSec@integ_sec
    General

    CVE-2026-40128: SAP NetWeaver Directory Traversal Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04nc_db0

    Post summary

    The text references a CVE related to an SAP NetWeaver directory traversal bug but offers no technical, exploit, or mitigation details, indicating a general informational post.

    0000024
    31 followersView on X

Explore more

Back to dashboard