Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2010-5326

78
FAUCET Score

CVE-2010-5326 describes an unauthenticated arbitrary code execution vulnerability in the Invoker Servlet of SAP NetWeaver Application Server Java platforms, affecting versions possibly before 7.3. This critical vulnerability (CVSS 10.0) allows remote attackers to execute code via HTTP/HTTPS requests due to a lack of authentication, leading to complete compromise of confidentiality, integrity, and availability. It has been actively exploited in the wild since at least 2013 as part of "Detour" attacks, with significant community discussion and media coverage, despite no public exploit code in Metasploit, Nuclei, or ExploitDB.

Impacted Technologies

VendorProductVersion(s)CPE
<= 7.30CPE matchmatch criteria
cpe:2.3:a:sap:netweaver_application_server_java:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

10.0CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
6.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
17.45%
Probability of exploitation in next 30 days
EPSS Percentile
96.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
Added to KEV · Nov 3, 2021
This CVE's current EPSS score of 0.1745 is in the 93rd percentile among its peer group of 36,829 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Remediation records are not available for this CVE.

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
service.sap.com / sap/support/notes/1445998
Permissions Required
onapsis.com / threat-report-tip-iceberg-wild-exploitation-cyber-attacks-sap-business-applications
Third Party Advisory
onapsis.com / research/publications/sap-security-in-depth-vol4-the-invoker-servlet-a-dangerous-detour-into-sap-java-solutions
Broken Link
securityfocus.com / bid/48925
Third Party AdvisoryVDB Entry
securityfocus.com / bid/90533
Third Party AdvisoryVDB Entry
us-cert.gov / ncas/alerts/TA16-132A
Third Party AdvisoryUS Government Resource