CVE-2026-40128

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java (Web Container) (affected versions not specified)

Description An unauthenticated attacker can craft a malicious HTTP logon request that manipulates file inclusion parameters. This enables path traversal, which is a method used to access files and directories that are stored outside the web root folder, and the processing of the included file. This action could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.