CVE-2010-5326

The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.

• CWE-306

• http://service.sap.com/sap/support/notes/1445998Permissions Required
• http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutionsBroken Link
• http://www.securityfocus.com/bid/48925Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/90533Third Party Advisory, VDB Entry
• http://www.us-cert.gov/ncas/alerts/TA16-132AThird Party Advisory, US Government Resource
• https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applicationsThird Party Advisory
• http://service.sap.com/sap/support/notes/1445998Permissions Required
• http://www.onapsis.com/research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutionsBroken Link
• http://www.securityfocus.com/bid/48925Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/90533Third Party Advisory, VDB Entry
• http://www.us-cert.gov/ncas/alerts/TA16-132AThird Party Advisory, US Government Resource
• https://www.onapsis.com/threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applicationsThird Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5326US Government Resource

Published

May 13, 2016

Last Modified

Jun 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-5320Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2010-5321Memory leak in drivers/media/video/videobuf-core.c in the vi…4.3
• CVE-2010-5322Cross-site scripting (XSS) vulnerability in ZeusCart 4.0 and…
• CVE-2010-5323Directory traversal vulnerability in UploadServlet in the Re…
• CVE-2010-5324Directory traversal vulnerability in UploadServlet in the Re…
• CVE-2010-5325Heap-based buffer overflow in the unhtmlify function in foom…
• CVE-2010-5327Liferay Portal through 6.2.10 allows remote authenticated us…
• CVE-2010-5328include/linux/init_task.h in the Linux kernel before 2.6.35 …
• CVE-2010-5329The video_usercopy function in drivers/media/video/v4l2-ioct…
• CVE-2010-5330On certain Ubiquiti devices, Command Injection exists via a …9.8
• CVE-2010-5331In the Linux kernel before 2.6.34, a range check issue in dr…7.8
• CVE-2010-5332In the Linux kernel before 2.6.37, an out of bounds array ac…5.6