Introduction
An unauthenticated path traversal flaw in the SAP NetWeaver Application Server Java Web Container lets any network-reachable attacker manipulate file inclusion parameters in HTTP logon requests. A successful attack can read sensitive files, modify data, or disrupt system availability. With a CVSS score of 9.0 and no authentication requirement, CVE-2026-40128 lands squarely in a category of SAP NetWeaver Java vulnerabilities that ransomware operators and state-sponsored threat groups have historically exploited quickly.
Technical Information
Root Cause: CWE-35 Path Traversal via Collapse Bypass
CVE-2026-40128 is classified under CWE-35: Path Traversal: '.../...//'. This weakness class depends on a subtle flaw in sequential input sanitization. When a security filter removes occurrences of "../" one pass at a time, the crafted string '.../...//' collapses into the canonical "../" traversal sequence after the first stripping pass. CWE-35 is formally linked to CWE-182 (Collapse of Data into Unsafe Value), in which the sanitization logic itself produces the dangerous output.
The vulnerability sits in the Web Container component of SAP NetWeaver Application Server Java. Because the Web Container handles HTTP request processing, including authentication and logon flows, it is a foundational component of the SAP Java stack.
Attack Flow
Based on the NVD description and the mechanics of CWE-35, exploitation proceeds in four steps:
-
The attacker sends a crafted, unauthenticated HTTP request to the logon endpoint of the SAP NetWeaver AS Java Web Container. No credentials, session tokens, or prior access are required.
-
The attacker injects sequences such as '.../...//' (or URL-encoded variants) into the logon request parameters that control file inclusion. If the Web Container's input validation relies on sequential stripping of "../", it fails to neutralize the collapsed traversal.
-
After the sanitization routine processes the input, the resulting path resolves to a location outside the restricted application directory. The attacker can target arbitrary files on the local filesystem.
-
The Web Container processes the traversed file rather than simply serving its raw contents, and this processing step is what raises the impact beyond pure information disclosure. Depending on the file targeted, the attacker can:
- view sensitive information such as configuration files, credentials, or application data (confidentiality impact)
- modify data through the file processing mechanism (integrity impact)
- render system components unavailable by targeting files critical to system operation (availability impact)
A single unauthenticated HTTP request can therefore compromise all three legs of the CIA triad.
Comparison with Prior SAP NetWeaver Java Path Traversal Vulnerabilities
The table below places CVE-2026-40128 alongside earlier SAP NetWeaver Java path traversal and access control vulnerabilities:
| CVE | Component | Weakness | CVSS | Exploitation Status |
|---|---|---|---|---|
| CVE-2020-6286 | LM Configuration Wizard | Path Traversal | 10.0 | Exploited in the wild |
| CVE-2025-31324 | Visual Composer Metadata Uploader | Missing Auth + Deserialization | 10.0 | Actively exploited by APT and ransomware groups |
| CVE-2026-40128 | Web Container (HTTP Logon) | Path Traversal (CWE-35) + File Inclusion | 9.0 | No confirmed exploitation as of publication |
CVE-2020-6286 used path traversal to download files (confidentiality only). CVE-2025-31324 combined missing authorization with deserialization for remote code execution. CVE-2026-40128 sits between the two. Its combination of path traversal and file inclusion enables viewing, modification, and denial of service, but based on available information it does not directly provide remote code execution.
Information Gaps
Public sources did not provide these technical details at the time of analysis:
- Specific affected version ranges of SAP NetWeaver AS Java
- The full CVSS vector string (the NVD record had not yet been enriched)
- The exact file inclusion parameters that can be manipulated
- Detailed exploit prerequisites beyond unauthenticated network access
Affected Systems and Versions
The affected component is the Web Container of SAP NetWeaver Application Server Java. Neither the NVD entry nor publicly available SAP advisories disclosed specific version ranges at the time of publication. SAP Security Note 3727078, available through the SAP Support Portal, contains the authoritative list of affected versions.
The Web Container is a core component of the SAP NetWeaver Java stack. Onapsis Research Labs has identified more than 10,000 internet-facing SAP applications. Visual Composer, a related but less fundamental Java component, was estimated to be deployed in 50% to 70% of SAP Java systems. As a foundational middleware layer, the Web Container likely has a comparable or larger deployment footprint.
Vendor Security History
SAP's NetWeaver Java stack has a documented pattern of path traversal and access control vulnerabilities:
CVE-2020-6286 (CVSS 10.0): A path traversal vulnerability in the LM Configuration Wizard of SAP NetWeaver AS Java let unauthenticated attackers download arbitrary files. It was widely exploited and prompted US-CERT alerts.
CVE-2025-31324 (CVSS 10.0): Multiple threat actor groups actively exploited a missing authorization check in the Visual Composer Metadata Uploader as a zero day. They included Russian ransomware operators (BianLian, RansomEXX/Storm-2460), the Qilin ransomware-as-a-service operation, and the China-nexus APT group Earth Lamia. Exploitation began approximately one month before SAP's public disclosure.
SAP Note 3476549: A directory traversal vulnerability in SAP NetWeaver AS Java affecting specific URLs starting with /scheduler/ui/js/.
CVE-2025-42937: A critical path traversal vulnerability in the SAP Print Service that enables file disclosure and credential theft.
Path traversal keeps recurring in the NetWeaver Java stack. That recurrence suggests the Web Container's file handling and input validation architecture has systemic weaknesses that extend beyond individual point patches.
SAP's monthly Security Patch Day program has consistently included critical-severity notes in 2026. March 2026 brought 15 new notes, 2 of them critical. April 2026 had 19 new notes with 1 critical, and May 2026 included 15 notes. CVE-2026-40128 was released as part of the June 9, 2026 patch day.
References
- NVD: CVE-2026-40128
- SAP Security Note 3727078
- SAP Security Patch Day Portal
- SAP Security Notes and News
- ASUG: What's New From SAP Security Patch June 2026
- CWE-35: Path Traversal '.../...//'
- Plexicus: CWE-35 Path Traversal Analysis
- Onapsis: CVE-2025-31324 SAP Zero Day Full Threat Analysis
- Onapsis: New Exploit for Critical SAP Vulnerability CVE-2025-31324
- Rapid7: Active Exploitation of SAP NetWeaver Visual Composer CVE-2025-31324
- SentinelOne: CVE-2020-6286 SAP NetWeaver Java Path Traversal
- Cybersecurity Dive: Critical Vulnerability in SAP NetWeaver Under Threat
- SAP NetWeaver AS Java Directory Traversal (SAP Note 3476549)
- Zeropath: CVE-2025-42937 SAP Print Service Path Traversal
- CSA Singapore: Critical Vulnerabilities in SAP
- OpenCVE: SAP NetWeaver Application Server Java CVEs
- SecurityBridge: SAP Patch Day Advisories
- ThreatDown: What is a Path Traversal Vulnerability
