# CVE-2021-38163: SAP NetWeaver - RCE

> Live exploitation tracking for CVE-2021-38163 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-38163

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **Public exploit available:** Yes
- **Affected products:** SAP NetWeaver
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software

## Description

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.

## CrowdSec analysis

[CVE-2021-38163](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-38163) is a path traversal vulnerability in SAP NetWeaver (Visual Composer 7.0 RT) versions 7.30 through 7.50, allowing authenticated non-administrative users to upload and execute malicious files. Exploitation of this flaw enables attackers to run arbitrary operating system commands with the privileges of the Java Server process, potentially leading to data theft, server modification, or complete denial of service.

CrowdSec has been tracking this vulnerability and its exploits since 27th of May 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2021-38163 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit SAP NetWeaver AS by uploading a malicious JSP webshell using a path traversal in the `parName` parameter, then execute arbitrary commands via the `/rtmfCommunicator/html/urgent.jsp` endpoint using the `cve` query parameter.

## Timeline

- 2021-09-14: CVE Published. CVE-2021-38163 is published to NVD.
- 2022-06-09: CISA KEV. CVE-2021-38163 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-06-30: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-05-27: Rule Released. CrowdSec releases a rule to detect CVE-2021-38163 exploitation attempts against the CrowdSec Network.

## References

- https://launchpad.support.sap.com/#/notes/3084487

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-38163) follows observed exploitation activity for CVE-2021-38163. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.