SAP NetWeaver - Path Traversal (CVE-2016-2389)

CVE-2016-2389 is a vulnerability in SAP Manufacturing Integration and Intelligence (xMII) that allows remote attackers to read arbitrary files due to improper validation of input paths in catalog requests, leading to a directory traversal scenario.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of May 2025.

CrowdSec network observations suggest that most exploitation of CVE-2016-2389 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2016-2389 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attempts to exploit this vulnerability typically involve requests to URLs containing /xmii/catalog with malicious path traversal sequences.