CVE-2017-12637: SAP NetWeaver AS Java directory traversal, unauthenticated file read
The short version: SAP NetWeaver Application Server Java has a directory-traversal flaw (CVE-2017-12637) that lets an unauthenticated attacker read arbitrary files from the server by walking the path in a scheduler request. It's old, it's been exploited in the wild since 2017, and CISA added it to the KEV catalog in 2025. If you run an internet-facing NetWeaver AS Java, confirm and patch. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS v2.0 (NVD) | 5.0 — Medium · AV:N/AC:L/Au:N/C:P/I:N/A:N |
| EPSS | 94.56% · 99.84th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-04-09 |
| Known exploited? | Yes — exploited in the wild since August 2017 |
| Vulnerability type | CWE-22 path traversal → unauthenticated arbitrary file read |
| Requires authenticated session? | No — pre-authentication |
| Affected | SAP NetWeaver Application Server Java 7.5 (SAP Security Note 2486657) |
| Fixed in | Per SAP Security Note 2486657 |
What you need to know
The flaw lives in the scheduler component (scheduler/ui/js/…/UIUtilJavaScriptJS), where a .. sequence in the query string escapes the intended directory. An unauthenticated attacker uses it to read files the application should never hand out.
- It's pre-authentication and trivial to automate. No credentials, and the request is a single crafted URL.
- File read on an app server is a stepping stone. Configuration files and secrets read from the host can seed deeper access — which is why NVD marks confidentiality High.
- It's genuinely old and genuinely exploited. Documented in-the-wild use dates to 2017; the 2025 KEV listing reflects that it never really went away on exposed, unpatched systems.
How serious we see it
High — and the practical case is stronger than the 7.5 might suggest at a glance.
An unauthenticated, network-reachable file read on an enterprise application server is a reliable reconnaissance-and-loot primitive, it's confirmed in KEV, and EPSS sits near the top. What holds it at High rather than Critical is scope: this reads files, it isn't direct code execution. The reassuring part is that it's narrow and fixable — a specific product line, a published SAP note, and quick to confirm from the outside.
Recommendations
Straight from SAP's guidance and CISA:
- Patch now. Apply the fix in SAP Security Note 2486657 for NetWeaver AS Java 7.5.
- Restrict exposure. Don't expose the AS Java scheduler/management surfaces to the internet; limit to trusted networks.
- Hunt if you were exposed. Review access logs for traversal patterns against the scheduler path and for reads of sensitive files.
- Rotate anything that may have leaked. If configuration or secrets were readable, treat them as exposed.
- Confirm your exposure first. Verify whether you run an internet-facing NetWeaver AS Java 7.5 at all.
How BreachRisk sees it
BreachRisk works this from the outside in. From little more than your domain it discovers exposed SAP NetWeaver, and because this threat is safely testable, it does more than fingerprint a banner: within bounded, non-disruptive limits it sends a single benign request to the affected path and confirms whether the traversal actually returns server content — the difference between "this looks like NetWeaver" and "this exposure is verified." KEV-listed findings like this rise to the top of your results, so an exposed, exploitable NetWeaver is flagged and confirmed rather than lost in a backlog.
References
- NVD — CVE-2017-12637
- CISA Known Exploited Vulnerabilities Catalog
- SAP Security Note 2486657 (SAP ONE Support Launchpad; sign-in required)