{"schemaVersion":3,"id":"CVE-2016-9563","aliases":[],"status":"published","duplicateOf":null,"title":"SAP NetWeaver XML External Entity (XXE) Vulnerability","description":"BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.","dates":{"published":"2016-11-23T02:00:00.000Z","modified":"2025-10-21T23:55:47.851Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2022-05-03T00:00:00.000Z"]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.24226,"percentile":0.97857,"severity":"high","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.24226},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.23805,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.23805,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.23805,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.24226,"percentile":0.97857}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.24226,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.24226,"percentile":0.97857}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"SAP NetWeaver XML External Entity (XXE) Vulnerability","description":"SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2016-9563","label":"nvd.nist.gov/vuln/detail/CVE-2016-9563"}],"vendor":"SAP","product":"NetWeaver","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"SAP NetWeaver XML External Entity (XXE) Vulnerability","description":"SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2016-9563","label":"nvd.nist.gov/vuln/detail/CVE-2016-9563"}],"vendor":"SAP","product":"NetWeaver","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference","description":"The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/611.html"}],"affected":[{"vendor":"sap","product":"netweaver_application_server_java","name":"netweaver application server java","label":"netweaver_application_server_java","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.50","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.50","eol":null,"hubHref":"/vendor/sap/netweaver_application_server_java"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securityfocus.com/bid/92419","label":"www.securityfocus.com/bid/92419","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://erpscan.io/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/","label":"erpscan.io/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/","hostname":"erpscan.io","tags":["X Refsource MISC","Broken Link","Third Party Advisory"]},{"url":"https://launchpad.support.sap.com/#/notes/2296909","label":"launchpad.support.sap.com","hostname":"launchpad.support.sap.com","tags":["X Refsource MISC","Permissions Required"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9563","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9563","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2016-11-23T02:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"SAP NetWeaver XML External Entity (XXE) Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-03T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:55:47.851Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T16:23:19.161Z","stale":false,"partial":false}}