HowToFixMe
● Medium · CVSS 6.5 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2016-9563: SAP NetWeaver XML External Entity (XXE) Vulnerability

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚡ At a glance
SeverityCVSS 6.5, Medium
Actively exploited?Yes, listed in CISA KEV (added 2021-11-03)
AffectedSAP NetWeaver AS JAVA (BC-BMT-BPM-DSK) 7.5
Fixed inSee vendor advisory
Type (CWE)CWE-611: Improper Restriction of XML External Entity Reference

Exploitation status

CVE-2016-9563 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “SAP NetWeaver XML External Entity (XXE) Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Public exploit availability: the vulnerability was disclosed by ERPScan (advisory ERPSCAN-16-034), whose public write-up documents the vulnerable bpemuwlconn endpoint and the XXE payload technique. Combined with its place on the CISA KEV catalog, treat weaponization as certain and patch on an emergency timeline.

Authoritative references:

⚠️ Patch immediately. CVE-2016-9563 is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03). Federal agencies had until 2022-05-03 to remediate.

What is CVE-2016-9563?

CVE-2016-9563 is an XML External Entity (XXE) injection flaw in the BC-BMT-BPM-DSK component of SAP NetWeaver Application Server Java 7.5. The vulnerable code path is the Universal Worklist connector servlet reached at the URI sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn. SAP tracks the fix as Security Note 2296909.

The underlying weakness is CWE-611, Improper Restriction of XML External Entity Reference. The servlet parses XML supplied in the request without disabling external entity resolution. An attacker who submits crafted XML containing a DOCTYPE with an external entity (for example, <!ENTITY x SYSTEM "file:///etc/passwd"> or a URL pointing at an internal host) causes the parser to fetch and embed that resource in the processed document. That gives the attacker arbitrary file read on the AS Java host and server-side request forgery against systems the SAP server can reach.

This is an information-disclosure vulnerability, not remote code execution. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (base 6.5, Medium) is precise about that: high impact on confidentiality, none on integrity or availability. The attack is network-reachable and needs only low privileges. the description says "remote authenticated users", so the attacker needs a valid (even low-privilege) application session, but no administrator rights. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2021-11-03, so exploitation in the wild is confirmed.

Am I affected?

You are exposed if you run SAP NetWeaver AS Java 7.5 with the Business Process Management desktop component (BC-BMT-BPM-DSK / the BPEM Universal Worklist connector) deployed and reachable. Two quick checks:

# Probe whether the BPEM UWL connector servlet is deployed and reachable.
# Replace host:port with your AS Java HTTP(S) port (default ICM ports are 5XX00).
curl -sk -o /dev/null -w "%{http_code}\n" \
  "https://sap-host:50001/sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn"
# 401/403/200 -> component present (assess patch level); 404 -> servlet not deployed here

How to fix CVE-2016-9563

There is no operating-system package, no apt/dnf update, and no winget entry for this. SAP components are patched inside SAP by applying the relevant Support Package Stack (SPS) or a standalone SAP Note correction through Software Update Manager (SUM). The authoritative instruction is SAP Security Note 2296909.

The MITRE record does not publish a single "fixed version" string, SAP delivers the correction as patch levels of the affected software component (the BC-BMT-BPM-DSK / BPEM packages) tied to your AS Java 7.5 Support Package level. Read Note 2296909 in the SAP ONE Support Launchpad to get the exact Support Package and patch number that applies to your installed software component version, then update to at least that level.

Remediation steps (SAP NetWeaver AS Java 7.5)

  1. Open SAP Security Note 2296909 in the SAP ONE Support Launchpad. It lists the affected software component versions and the Support Package / patch level that contains the corrected parser configuration.
  2. Check your current level. In SAP NetWeaver Administrator, go to Operations → Systems → Software Components (or use the System Information page at /nwa/sysinfo) and note the patch level of the BC-BMT-BPM-DSK / BPEM component on AS Java 7.5.
  3. Stage the fix. Download the required Support Package or patch from the Launchpad, or use Maintenance Planner to build a queue, then apply it with Software Update Manager (SUM) through the JSPM/SUM workflow. Apply to a sandbox or QA system first.
  4. Restart the affected instance if SUM does not bounce the server cluster itself, so the redeployed component loads.
  5. Re-test the servlet with a known XXE probe payload and confirm external entities are no longer resolved (see verification below).

If your landscape is on a newer NetWeaver release or has BPM/BPEM bundled into a broader SPS, apply the full Support Package Stack that supersedes Note 2296909 rather than the standalone correction: SAP rolls older note fixes forward into later SPS levels.

If you can't patch immediately

Patching via Note 2296909 is the only fix SAP documents. Until you can schedule the SUM run, reduce exposure with compensating controls, these limit who can reach the vulnerable servlet, they do not close the flaw.

# SAP Web Dispatcher permission table (icm/HTTP/auth_<n> or Pfilter):
# Deny the vulnerable BPEM UWL connector path from anywhere outside the admin subnet.
P  DENY  /sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn*  *
P  PERMIT /sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn*  10.0.0.0/24

# Network-level restriction on the SAP host firewall (Linux example).
# Replace 50001 with your AS Java HTTPS ICM port and 10.0.0.0/24 with your trusted subnet.
sudo iptables -A INPUT -p tcp --dport 50001 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 50001 -j DROP

Because exploitation requires an authenticated session, also review and tighten worklist/BPM application role assignments so that low-privilege accounts that do not need the Universal Worklist cannot reach the connector at all.

Verify the fix worked

After applying the Support Package, confirm the BC-BMT-BPM-DSK / BPEM component patch level meets or exceeds the level named in Note 2296909. read it back from NetWeaver Administrator (Software Components) or the /nwa/sysinfo page. Then prove the parser no longer resolves external entities:

# Send a benign XXE test payload to the patched servlet and confirm the external
# entity is NOT expanded in the response. A patched server rejects/ignores the DOCTYPE.
curl -sk -u "testuser:password" \
  -H "Content-Type: text/xml" \
  --data-binary @- \
  "https://sap-host:50001/sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn" <<'XML'
<?xml version="1.0"?>
<!DOCTYPE test [ <!ENTITY probe SYSTEM "file:///etc/hostname"> ]>
<test>&probe;</test>
XML
# Patched: the hostname does NOT appear in the response and the DOCTYPE is ignored/blocked.

Finally, re-run the vulnerability scanner that originally flagged CVE-2016-9563, and review ICM and application logs for prior requests to the bpemuwlconn path containing DOCTYPE or ENTITY declarations, those are the signature of an attempted XXE read, and matter most if the instance was internet-reachable before patching.

Frequently asked questions

What kind of vulnerability is CVE-2016-9563: is it remote code execution?

No. It is an XML External Entity (XXE) injection (CWE-611) that leads to information disclosure: arbitrary file read on the AS Java host and server-side request forgery to systems the SAP server can reach. The CVSS 3.1 vector shows high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N), which is why the base score is 6.5 Medium rather than higher.

Does an attacker need credentials to exploit this?

Yes, the MITRE description specifies "remote authenticated users", and the CVSS vector lists PR:L (low privileges required). The attacker needs a valid, even low-privilege, AS Java session, but no administrator rights and no user interaction. That is why tightening worklist/BPM role assignments is a useful interim control.

What exactly do I patch. is there a fixed version number?

You apply SAP Security Note 2296909 to SAP NetWeaver AS Java 7.5. SAP does not publish one universal "fixed version"; the correction ships as a Support Package / patch level of the BC-BMT-BPM-DSK (BPEM) software component tied to your AS Java Support Package level. Read Note 2296909 in the SAP ONE Support Launchpad for the exact level that applies to your installed component, and use Software Update Manager to apply it.

Is CVE-2016-9563 actively exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, and it was originally disclosed with a public advisory by ERPScan (ERPSCAN-16-034). U.S. federal agencies were required to remediate it under Binding Operational Directive 22-01 by 2022-05-03; treat it as an emergency patch regardless of sector.

References

Written by Sai Kiran Pandrala on 2026-05-25. Sourced from the official vendor advisory, the NVD record, and the CISA KEV listing. Always confirm against the vendor advisory before applying changes in production.

Other CVEs touching related code paths, worth patching together with this one:

People also ask

What kind of vulnerability is CVE-2016-9563, is it remote code execution?

No. It is an XML External Entity (XXE) injection (CWE-611) that leads to information disclosure: arbitrary file read on the AS Java host and server-side request forgery. The CVSS 3.1 vector shows high confidentiality impact but none on integrity or availability (C:H/I:N/A:N), which is why the base score is 6.5 Medium.

Does an attacker need credentials to exploit CVE-2016-9563?

Yes. The MITRE description specifies "remote authenticated users" and the CVSS vector lists PR:L (low privileges required). The attacker needs a valid, even low-privilege, AS Java session, but no administrator rights and no user interaction.

What exactly do I patch: is there a fixed version number?

You apply SAP Security Note 2296909 to SAP NetWeaver AS Java 7.5. SAP ships the correction as a Support Package / patch level of the BC-BMT-BPM-DSK (BPEM) component, not a single universal version. Read the note in the SAP ONE Support Launchpad for the exact level and apply it with Software Update Manager.

Is CVE-2016-9563 actively exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, and it was originally disclosed publicly by ERPScan (ERPSCAN-16-034). Federal agencies had to remediate it by 2022-05-03 under BOD 22-01.