BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~…

Published 9 y ago 2016-11-23 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.1 · CNA

CISA KEV

Yes

added 2021-11-03

EPSS

24.2%

percentile 98%

Public exploits

none known

BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.

Known exploited (CISA KEV)

Added: 5 y ago 2021-11-03
Due date: 2022-05-03 (4 y ago)
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Vendor / product: SAP / NetWeaver
CISA name: SAP NetWeaver XML External Entity (XXE) Vulnerability

CISA SSVC assessment

Exploitation: Active — exploited in the wild
Automatable: no
Technical impact: partial
Assessed: 20 mo ago 2025-02-07

Exploit prediction (EPSS)

24.23% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
CNA	3.1	6.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	4.0	`AV:N/AC:L/Au:S/C:P/I:N/A:N`

Classification

Weakness

CWE-611 Improper Restriction of XML External Entity Reference

References

securityfocus.com /bid/92419 · vdb-entry, x_refsource_BID, x_transferred
erpscan.io /advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/ · x_refsource_MISC, x_transferred
launchpad.support.sap.com /#/notes/2296909 · x_refsource_MISC, x_transferred
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-9563 · government-resource

Sources

CVE List: CVE-2016-9563
NVD: CVE-2016-9563

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary