SAP NetWeaver - Path Traversal (CVE-2016-2389)

CVE-2016-2389 is a vulnerability in SAP Manufacturing Integration and Intelligence (xMII) that allows remote attackers to read arbitrary files due to improper validation of input paths in catalog requests, leading to a directory traversal scenario.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of May 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2016-2389 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2016-2389 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2016-2389 is currently experiencing high visibility and active exploitation across the internet.

Attempts to exploit this vulnerability typically involve requests to URLs containing /xmii/catalog with malicious path traversal sequences.