How to Fix CVE-2010-5326: SAP NetWeaver Remote Code Execution Vulnerability

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚠️ Fix immediately. CVE-2010-5326 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03). Federal agencies had until 2022-05-03 to remediate. There is no "version bump" here: the fix is a configuration change: disable the Invoker Servlet per SAP Note 1445998. SAP Security Note 1445998 is the authoritative remediation.

What is CVE-2010-5326?

CVE-2010-5326 is an unauthenticated remote code execution flaw in the Invoker Servlet on SAP NetWeaver Application Server Java (AS Java). The Invoker Servlet is a legacy servlet-container feature that lets a request invoke any deployed servlet directly by its class name, without going through the URL mapping declared in web.xml. On affected AS Java releases (the record notes "possibly before 7.3") this invocation path does not enforce authentication. A remote attacker who can reach the HTTP or HTTPS listener can call a servlet that runs code, with no login and no user interaction.

This is classified as CWE-306: Missing Authentication for Critical Function. It is a true unauthenticated RCE, not a privilege-escalation or denial-of-service bug, which is why it carries the maximum CVSS base score of 10.0 (Critical): network attack vector, low complexity, no privileges, no user interaction, and a changed scope with full confidentiality, integrity, and availability impact. Onapsis researchers documented this attack publicly under the name "Detour", and it was exploited in the wild against SAP business systems between 2013 and 2016. In May 2016 US-CERT issued alert TA16-132A specifically about the Invoker Servlet exposure.

The critical nuance: this is a misconfiguration that ships enabled on older AS Java builds, not a code bug you patch with a binary. The remediation is to disable the Invoker Servlet, globally and per-application. exactly as SAP describes in Security Note 1445998. From SAP NetWeaver 7.3 onward the Invoker Servlet is disabled by default, which is the source of the "possibly before 7.3" wording in the record.

Am I affected?

You are exposed if you run an SAP NetWeaver AS Java instance whose Invoker Servlet is still enabled, most commonly NetWeaver 7.0x, 7.1x, 7.2x, or any later build where someone re-enabled it. The fastest external check is to request a known servlet through the invoker path. On an affected system the call reaches the servlet directly; on a hardened system it returns 403/404.

# Probe the Invoker Servlet path against your AS Java host (test from an authorized box only).
# A 200/handler response instead of 403/404 indicates the Invoker Servlet is still reachable.
curl -sk -o /dev/null -w '%{http_code}\n' \
  "https://as-java.example.com:50001/servlet/com.sap.engine.docs.examples.servlet.TestServlet"

To confirm authoritatively, check the servlet configuration inside the AS Java itself. The relevant property lives on the servlet_jsp service of the ICM/Web Container. Log in to the SAP NetWeaver Administrator (NWA) or the offline Config Tool and inspect EnableInvokerServletGlobally on the servlet_jsp service. If it is true, you are vulnerable.

How to fix CVE-2010-5326

The fix is a configuration change documented in SAP Security Note 1445998, not an OS package upgrade. There is no apt, dnf, or winget command for this: AS Java is a Java application server administered through SAP's own tools. Apply the change at two levels: globally (turn the Invoker Servlet off for the whole engine) and per-application (so individual web applications cannot turn it back on).

Step 1, Disable the Invoker Servlet globally (NWA)

1. Open SAP NetWeaver Administrator at https://<host>:<port>/nwa.
2. Go to Configuration → Infrastructure → Java System Properties.
3. Select the Services tab and choose the servlet_jsp service.
4. Set the property EnableInvokerServletGlobally to false.
5. Save. The change applies to all newly started applications; restart the AS Java instances (or do a rolling restart across the cluster) so every node picks up the global setting.

If the GUI is unavailable, the same property can be set offline with the AS Java Config Tool (configtool.sh / configtool.bat under /usr/sap/<SID>/<instance>/j2ee/configtool) by editing the servlet_jsp service properties and restarting the engine.

Step 2. Disable per application

The global flag stops the default behaviour, but a deployed web application can still ship its own <servlet> mapping for the invoker. Per SAP Note 1445998, also clear the application-level override so individual apps cannot re-enable it:

1. In NWA go to Operations → Systems → Start & Stop → Java Applications (or use the Visual Administrator on very old releases).
2. For each deployed web application, ensure the servlet_jsp property EnableInvokerServletGlobally is not overridden to true at the application scope.
3. Redeploy or restart the affected applications so the cleared setting takes effect.

Step 3, Upgrade AS Java where you can

From SAP NetWeaver AS Java 7.3 onward the Invoker Servlet is disabled by default, so moving to a current support package stack removes the exposure as a side effect and keeps you on a maintained release. The record does not name a single "fixed version": the authoritative source is SAP Security Note 1445998 and the AS Java release notes. Do not trust a third-party "fixed in X.Y" claim; confirm the Invoker Servlet state directly on your engine after any upgrade or support-package import.

⚠️ Do not look for an OS patch. Generic package-manager commands (apt-get install --only-upgrade, dnf update, winget upgrade, MSI installers) do not apply to SAP NetWeaver AS Java and will not remediate CVE-2010-5326. The only correct fix is the SAP Note 1445998 configuration change plus, where feasible, an AS Java upgrade.

If you can't change config immediately

If you cannot restart the engine right away, reduce exposure at the network edge while you schedule the change. These are mitigations, not the fix.

Block the Invoker Servlet path at the reverse proxy / Web Dispatcher

# Reject any request that uses the /servlet/ invoker path before it reaches AS Java.
location ~* ^/servlet/ {
    return 403;
}
# Restrict the AS Java HTTP/HTTPS ports to trusted admin networks only.
allow 10.0.0.0/8;
deny  all;

On the SAP Web Dispatcher, add a permission table (icm/HTTP/auth_<n> / wdisp/permission_table) rule that denies URLs matching /servlet/*. Never leave an AS Java instance with the Invoker Servlet enabled directly exposed to the internet, even temporarily.

Verify the fix

After disabling the Invoker Servlet and restarting the engine, re-run the same probe and confirm the path is now refused:

# Should now return 403 or 404, not the servlet handler.
curl -sk -o /dev/null -w '%{http_code}\n' \
  "https://as-java.example.com:50001/servlet/com.sap.engine.docs.examples.servlet.TestServlet"

# Also confirm the engine property is now false.
# In NWA: Configuration -> Java System Properties -> servlet_jsp -> EnableInvokerServletGlobally = false

Then re-run your vulnerability scanner and confirm the CVE-2010-5326 finding has cleared. Because the system was a known in-the-wild target, sweep AS Java HTTP access logs (and the ICM trace) for historical /servlet/ requests with unexpected class names, and review deployed applications for any web shell or rogue servlet that may have been planted while the engine was exposed. Cross-check against the indicators and guidance in US-CERT alert TA16-132A.

Frequently asked questions

Is there a software version that fixes CVE-2010-5326?

There is no single patched build to upgrade to. The fix is a configuration change, disable the Invoker Servlet as described in SAP Security Note 1445998. As a durable measure, AS Java 7.3 and later ship with the Invoker Servlet disabled by default, so upgrading to a current release removes the default exposure. Always confirm the setting on your own engine; do not rely on a third-party "fixed-in" version number.

How do I disable the Invoker Servlet?

In SAP NetWeaver Administrator, open Configuration → Java System Properties, select the servlet_jsp service, set EnableInvokerServletGlobally to false, save, and restart the AS Java instances. Then clear any per-application override so individual web apps cannot turn it back on. SAP Note 1445998 documents both steps.

Does this affect SAP NetWeaver ABAP?

No. The Invoker Servlet is part of the Java stack (AS Java / the J2EE servlet container). ABAP-only systems do not run the Invoker Servlet and are not affected by CVE-2010-5326. Dual-stack systems with a Java engine are affected and must apply the SAP Note 1445998 change on the Java side.

Why is this rated CVSS 10.0 when the CVE is from 2010?

The disclosure date does not lower the risk. The flaw allows unauthenticated remote code execution over the network with no user interaction and full impact to confidentiality, integrity, and availability, which maxes the CVSS 3.1 base score at 10.0. It was actively exploited in the wild from 2013 to 2016 and added to the CISA KEV catalog on 2021-11-03, so it remains a mandatory, emergency-priority fix wherever an affected AS Java engine still has the Invoker Servlet enabled.

References

• Official vendor advisory: http://www.securityfocus.com/bid/90533
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2010-5326
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Additional reference: https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications
• Additional reference: http://service.sap.com/sap/support/notes/1445998
• Additional reference: http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions

Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other defects in the same area that deserve attention during this patch cycle:

• How to Fix CVE-2010-1428: Exposed Dangerous Method or Function in Jboss
• How to Fix CVE-2010-5330: Command Injection in Ubiquiti AirOS
• How to Fix CVE-2010-0738: Exposed Dangerous Method or Function in Jboss
• How to Fix CVE-2010-4345: Command Injection in Exim
• How to Fix CVE-2010-3765: Memory Corruption in Multiple Products