How to Fix CVE-2016-2388: Exposure of Sensitive Information to an Unauthorized Actor in Netweaver

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-06-09, federal due date 2022-06-30.

What is CVE-2016-2388?

CVE-2016-2388 is an information-disclosure flaw (CWE-200, Exposure of Sensitive Information to an Unauthorized Actor) in the Universal Worklist (UWL) Configuration component of SAP NetWeaver Application Server Java 7.4. A remote, unauthenticated attacker sends a crafted HTTP request to the UWL configuration interface and receives sensitive user information back in the response. SAP tracks the fix as SAP Security Note 2256846. This is read-only information leakage, not remote code execution and not privilege escalation: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which scores confidentiality impact only (5.3, Medium).

The Universal Worklist is a standard NetWeaver AS Java application that aggregates tasks, alerts, and notifications for end users across SAP back-end systems. Because the leak comes from the UWL configuration servlet, the exposed data can include account and configuration details that help an attacker map users and plan follow-on attacks. The flaw was disclosed publicly by ERPScan as advisory ERPSCAN-16-010 in May 2016, after SAP shipped the note in its February 2016 patch day.

Why this CVE matters

An unauthenticated information leak on an internet-reachable or widely-reachable SAP application server is high-value reconnaissance. CISA placed CVE-2016-2388 on the Known Exploited Vulnerabilities catalog on 2022-06-09, which only happens after confirmed exploitation in the wild. A working exploit module is published on Exploit-DB (entry 39841), so opportunistic scanning and weaponization should be assumed. NetWeaver AS Java commonly fronts portals, process integration, and other business-critical Java stacks, so a configuration leak here often feeds directly into broader SAP compromise.

Identify

This bug lives in SAP NetWeaver AS Java 7.4, it is not a Linux package or a Windows MSI, so check it the SAP way. Confirm your AS Java release and Support Package level, then confirm whether SAP Note 2256846 is applied.

• Check the kernel and SP level: open the SAP NetWeaver Administrator (NWA) at https://<host>:<port>/nwa → System Information → Components Info, and note the version of the software component that ships the Universal Worklist (UWLJWF / UWL).
• Check note status: in SAP Solution Manager or the System Recommendations app (transaction /n SYSTEM_RECOMMENDATIONS on the connected ABAP/Solution Manager), look for SAP Security Note 2256846 and whether it is reported as missing for the connected AS Java system.
• Confirm UWL is deployed and reachable: if the UWL application responds at its configuration URL without authentication, treat the system as exposed until the note is confirmed applied.

How to fix CVE-2016-2388

There is no apt, dnf, or winget package for this. The fix is delivered by SAP as SAP Security Note 2256846, applied to the affected NetWeaver AS Java 7.4 system. SAP does not publish a single public “fixed version” string for this note in the MITRE record: the corrected component level is named inside the note itself on the SAP Support Portal, so retrieve the note and apply the Support Package or patch it specifies for your exact AS Java release.

Apply SAP Security Note 2256846

1. Download the note. Sign in to the SAP Support Portal (formerly SAP ONE Support Launchpad) at https://launchpad.support.sap.com/#/notes/2256846 with an account that has download authorization for your installation number. Read the “Correction Instructions” and “Support Packages & Patches” sections to find the exact patched Support Package Stack (SPS) or component patch for your AS Java 7.4 build.
2. Stage the patch. Pull the corresponding patch for the affected software component (the Universal Worklist component) from the Software Downloads area, matching your kernel and SP level. Do not apply a patch built for a different SP level.
3. Deploy with SUM / JSPM. Apply the patch using the Software Update Manager (SUM) or the Java Support Package Manager (JSPM) for AS Java. These are the supported tools for deploying SCA/SDA component updates to a NetWeaver Java stack; deploy into a non-production system first.
4. Restart the affected cluster nodes. After deployment, restart the AS Java instance so the corrected UWL component is loaded on every server node.

Always test SAP notes in a sandbox or QA system that mirrors your production SP level before promoting to production. Information-disclosure corrections in standard components are usually low-risk, but UWL is integrated with portal and back-end task flows, so validate that worklist functionality still works after patching.

Follow the SAP transport path

Promote the fix through your landscape the way you promote any SAP change: apply and validate in development/QA, run a functional check of the Universal Worklist for affected users, then schedule the production deployment as an emergency change given the KEV listing. Record the applied note and patch level in your change record so the next audit can confirm 2256846 is closed.

If you can't patch immediately

Applying SAP Note 2256846 is the only durable fix. These mitigations reduce exposure while the change window is scheduled, they do not remove the vulnerability.

• Restrict reachability. The flaw is exploited over HTTP/HTTPS to the AS Java instance. Put the system behind the corporate network and a reverse proxy, and restrict access to the UWL paths to authenticated, internal users only. An internet-exposed NetWeaver AS Java should not be reachable by anonymous clients.
• Filter at SAP Web Dispatcher. If you front AS Java with SAP Web Dispatcher, use permission and URL filtering (icm/HTTP/auth_ and Web Dispatcher permission tables) to block unauthenticated access to the UWL configuration URL rather than exposing it broadly.
• Tighten UWL configuration access. Review the UWL system configuration in the portal so only administrators can read configuration data, and remove any anonymous access to the worklist configuration endpoint.

# SAP Web Dispatcher permission table (icm/HTTP/mod_0) example:
# deny anonymous access to the UWL configuration path, allow your admin network.
# Place in the permission file referenced by icm/HTTP/mod_<n> = PREFIX=/,FILE=...
if %{REMOTE_ADDR} !stricmp 10.0.0.0/8
  RegIRedirectUrl ^/webdynpro/dispatcher/sap.com/.*[Uu][Ww][Ll].* 403 deny
endif

Treat the above as a stop-gap pattern to adapt to your exact UWL URL prefix. a determined attacker who knows the request shape can still reach the bug if the component is unpatched.

Resolve

After applying SAP Note 2256846, confirm the corrected component level is live and the leak is closed.

• Re-check the note status in System Recommendations / Solution Manager: note 2256846 should no longer be reported as missing for the AS Java system.
• Confirm the component patch level in NWA → Components Info matches the patched level named in the note.
• Re-test the request. Reissue the crafted UWL configuration request that previously leaked data and confirm the server now refuses it or returns no sensitive information.
• Run an authenticated SAP-aware scan (for example, a tool that consumes SAP Security Notes) and confirm it no longer flags CVE-2016-2388.

Because this CVE is on the CISA KEV list, if the system was reachable by untrusted clients while unpatched, review your AS Java HTTP access logs and the ICM/Web Dispatcher logs over the full exposure window for repeated requests to the UWL configuration path, and rotate any credentials or secrets the exposed configuration data could have revealed.

Frequently asked questions

Which SAP component and version does CVE-2016-2388 affect?

The Universal Worklist (UWL) Configuration in SAP NetWeaver Application Server Java 7.4. A remote, unauthenticated attacker sends a crafted HTTP request and gets sensitive user information back. It is an information-disclosure flaw (CWE-200), not RCE, CVSS 5.3 Medium, confidentiality impact only.

What is the fix and where do I get it?

SAP Security Note 2256846. Download it from the SAP Support Portal at launchpad.support.sap.com/#/notes/2256846, then apply the Support Package or component patch it names for your exact AS Java 7.4 build using SUM or JSPM and restart the instance. There is no apt, dnf, or winget package for this: it is an SAP note, not an OS update.

Is CVE-2016-2388 being exploited in the wild?

Yes. CISA added CVE-2016-2388 to the Known Exploited Vulnerabilities catalog on 2022-06-09, and a public exploit is published on Exploit-DB (entry 39841). Treat patching as an emergency change for any reachable AS Java 7.4 system.

Can I just put a WAF or firewall in front of it instead of patching?

That reduces exposure but is not a fix. Restricting the UWL configuration path to authenticated internal users (via SAP Web Dispatcher or a reverse proxy) slows opportunistic scanning, but an attacker who can still reach the unpatched component can trigger the leak. Apply SAP Note 2256846.

References

• Official vendor advisory: http://seclists.org/fulldisclosure/2016/May/55
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2016-2388
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV record: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2388
• Additional reference: http://packetstormsecurity.com/files/137128/SAP-NetWeaver-AS-JAVA-7.5-Information-Disclosure.html
• Additional reference: https://erpscan.io/advisories/erpscan-16-010-sap-netweaver-7-4-information-disclosure/
• Additional reference: https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/
• Additional reference: https://www.exploit-db.com/exploits/39841/

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV catalog entry on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Nearby vulnerabilities you may as well remediate alongside this fix:

• How to Fix CVE-2016-3235: DLL side-loading in Microsoft Office Visio
• How to Fix CVE-2016-2386: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
• How to Fix CVE-2016-0752: Path Traversal in Rails Ruby on Rails
• How to Fix CVE-2016-7255: Privilege escalation in Microsoft Windows Win32k
• How to Fix CVE-2016-0167: Privilege escalation in Microsoft Windows Win32k