TI-2016-03084 Aliases CVE-2016-3635 GHSA-hh9w-j6fc-233m

SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified…

LOW 38CWE-284Published 2016-10-13 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly, aka SAP Security Note 2139366.

Why it matters now

EPSS 0.02444 84th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sap:netweaver:7.40:::::::*	7.40	Vulnerable	SAP

cpe:2.3:a:sap:netweaver:7.40:*:*:*:*:*:*:* Versions 7.40 Vulnerable ·SAP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2016-3635
2026-10-03 Alias added: GHSA-hh9w-j6fc-233m

References

Advisory 1

20161011 Onapsis Security Advisory ONAPSIS-2016-002: SAP UCON Security Protection bypass

Other 1

https://www.onapsis.com/research/security-advisories/sap-ucon-security-protection-bypass

TI-2025-22522 Missing Authorization check in SAP NetWeaver (Visual Composer development server) KEVCVSS 3.1CRITICAL 10.0
TI-2021-15842 Path traversal in SAP NetWeaver KEVCVSS 3.1CRITICAL 9.9
TI-2025-27866 Insecure Deserialization in SAP NetWeaver (Visual Composer development server) KEVCVSS 3.1CRITICAL 9.1
TI-2012-02262 The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313… CVSS 2.0HIGH 9.3
TI-2013-01399 A Buffer Overflow vulnerability exists in the Message Server service… CVSS 3.1CRITICAL 9.8
TI-2016-02149 Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing… CVSS 3.0HIGH 7.5

See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences