SAP NetWeaver Java Application Server Invoker Servlet Authentication Bypass Remote Code Execution (CVE-2010-5326)
Executive & SecOps Summary
SECOPS ASSESSMENTSAP NetWeaver Application Server Java platforms, typically prior to version 7.3
Unauthenticated remote attackers can execute arbitrary OS commands and Java code via crafted HTTP/HTTPS requests (CVSS 10.0)
Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patch provided in SAP Note 1445998. It is highly recommended to upgrade the SAP NetWeaver Java Application Server to version 7.3 or higher, where the Invoker Servlet is disabled by default.
2. Temporary Workaround & Hardening Configuration
To mitigate the vulnerability immediately without upgrading, disable the Invoker Servlet by commenting out its mapping in the global 'web.xml' configuration file:
<!-- Locate and comment out the invoker servlet mapping in web.xml -->
<!--
<servlet-mapping>
<servlet-name>invoker</servlet-name>
<url-pattern>/servlet/*</url-pattern>
</servlet-mapping>
-->3. Log Audit & IoC Verification Commands
Search the SAP HTTP access logs for unauthorized attempts to access the Invoker Servlet or execute administrative classes using the following commands:
# Scan SAP HTTP access logs for any requests containing '/servlet/'
grep -i '/servlet/' /usr/sap/*/j2ee/cluster/server*/log/system/http_access.*.log
# Identify potential exploitation attempts targeting deployment or administrative classes
egrep -i '(invoker|deploy|sap.com)' /usr/sap/*/j2ee/cluster/server*/log/system/http_access.*.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the 'Invoker Servlet' component of the SAP NetWeaver Application Server Java platform due to a lack of authentication requirements (CWE-306). The Invoker Servlet is designed to allow direct invocation of servlets by their class names without explicit servlet mapping definitions. However, because this servlet is exposed without authentication by default, remote attackers can bypass standard access controls and directly interact with internal administrative servlets.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a specially crafted HTTP POST or GET request targeting the '/servlet/org.apache.catalina.servlets.InvokerServlet' path (or equivalent invoker paths). By passing administrative or deployment-related servlet classes as parameters, the attacker bypasses authentication checks and forces the application server to load and execute arbitrary Java classes. This technique, known as a 'Detour' attack, allows attackers to upload web shells or execute operating system commands with the privileges of the SAP service account.
3. Infrastructure & Business Impact
With a CVSS score of 10.0 (Critical) and inclusion in the CISA KEV catalog, this vulnerability represents an extreme threat vector that has been actively exploited in the wild. Successful exploitation grants full administrative control over the SAP Java environment, enabling attackers to compromise ERP, CRM, and other critical business systems, leading to massive data breaches, intellectual property theft, and complete operational disruption.
Official Vendor Advisories & References
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
Frequently Asked SecOps Questions (CVE-2010-5326)
FAQQ1. How critical is CVE-2010-5326 and is it actively exploited in the wild?
CVE-2010-5326 is rated CVSS 10.0 (CRITICAL) with a 30-day EPSS exploitation probability of 17.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2010-5326?
Primary impacted vendors include sap across netweaver_application_server_java. Scope summary: SAP NetWeaver Application Server Java versions prior to 7.3 (where Invoker Servlet is enabled)
Q3. What temporary mitigations or workarounds exist for CVE-2010-5326 before patching?
[Mitigation] Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2010-5326
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (sap)
View Category →Microsoft Office SharePoint Missing Authentication Privilege Escalation Vulnerability (CVE-2026-56164) Security Advisory
[Affected Scope] Microsoft Office SharePoint Server environments
Oracle PeopleSoft Enterprise PeopleTools Remote Code Execution and System Takeover Vulnerability (CVE-2026-35273)
[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62
Splunk Enterprise Unauthenticated Arbitrary File Creation and RCE via PostgreSQL Sidecar Service (CVE-2026-20253)
[Affected Scope] Splunk Enterprise versions 10.2.x below 10.2.4 and 10.0.x below 10.0.7 (versions 9.4 and earlier are unaffected)
Oracle E-Business Suite Payments File Transmission Authentication Bypass and Remote Code Execution (CVE-2026-46817)
[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.