SAPExploited incident
SAP NetWeaver AS Java scheduler directory traversal (2017 bug, KEV 2025)
CVE-2017-12637High, CVSS 7.7In CISA's Known Exploited Vulnerabilities catalog since 19 Mar 2025
- Exploited before a fix
Response
- Silence
- 1d First public report to first vendor statement
- Exposure
- 1d First public report to first fix
- Follow-through
- not dated First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
CVE-2017-12637 record (MITRE CNA)CuratedQuote verified
"datePublished":"2017-08-07T20:00:00.000Z"
Record text: 'as exploited in the wild in August 2017, aka SAP Security Note 2486657'.
- Source
- CVE-2017-12637 record (MITRE CNA) cve record
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:7370551a4ebbac70…- Used in metrics
- Yes
4 more sources for this moment
Researcher post 'CVE-2017-12637' on sh0w.top (Wayback capture 2017-08-07 20:20 UTC)CuratedQuote verified7 Aug 2017
2017.08.07 22:55:00
Post timestamp has no time zone, so day precision. It publishes the attack vector '/scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS?../../...' against 'SAP NetWeaver Application Server Java'. It is the reference cited in the CVE record.
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:c5b41cad8ea6f7af…- Used in metrics
- No, kept for the record
CVE.org record CVE-2017-12637ClaimedQuote verified7 Aug 2017, 20:00 UTC
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot
CVE record published.
- Source
- CVE.org record CVE-2017-12637 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:7370551a4ebbac70…- Used in metrics
- No, kept for the record
CISA KEV (CVE-2017-12637)ClaimedQuote verified19 Mar 2025
SAP NetWeaver Directory Traversal Vulnerability
Added to CISA's KEV catalog on 2025-03-19.
- Source
- CISA KEV (CVE-2017-12637) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet19 Mar 2025, 18:15 UTC
CVE-2017-12637
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Vendor statement
date only+1d
SAP Product Security Response: SAP Security Patch Day - August 2017 (Wayback capture)CuratedQuote verified
August 8, 2017
Post date in the byline ('SAP Security Patch Day – August 2017 / August 8, 2017'). Body: 'On 8th of August 2017, SAP Security Patch Day saw the release of 16 security notes.' The list includes '2486657 Directory Traversal vulnerability in SAP NetWeaver AS Java Web Container' (High, SAP CVSS 7.7). Re-quoted 2026-10-23: the body sentence crosses <sup> markup.
- Source
- SAP Product Security Response: SAP Security Patch Day - August 2017 (Wayback capture) vendor blog
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:84e214733a4062ea…- Used in metrics
- Yes
First workaround
No official mitigation found yet.
First fix
date only+1d
SAP Product Security Response: SAP Security Patch Day - August 2017 (Wayback capture)CuratedQuote verified
2486657 Directory Traversal vulnerability in SAP NetWeaver AS Java Web Container
Security Note 2486657 released on the 2017-08-08 Patch Day; the CVE record equates the CVE with this note.
- Source
- SAP Product Security Response: SAP Security Patch Day - August 2017 (Wayback capture) vendor blog
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:84e214733a4062ea…- Used in metrics
- Yes
Fixed for all versions
No evidence yet of fixed releases for every supported branch.
Send this to your boss
No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.
Affected products
- SAP NetWeaver Application Server Java 7.5 (scheduler web UI / Web Container)
How we built this timeline
Old bug, KEV-listed 19 Mar 2025. The public disclosure (researcher post and MITRE CVE record, 7 Aug 2017) came one day before SAP's Patch Day note (8 Aug 2017), so exposure is about one day. exploited before a fix=true under R4 (was null before the 23 Oct 2026 correction pass): NVD's change history (Wayback capture 28 Oct 2020) shows that the description as first published on 7 Aug 2017 already read '... as exploited in the wild in August 2017.' ('aka SAP Security Note 2486657' was added on 28 Aug 2017), so exploitation was publicly reported a day before SAP's 8 Aug 2017 Patch Day fix.
The claim's own basis is not documented. SAP's note content and the list of fixed support packages are behind SAP login, so Fixed for all versions is not recorded.
KEV's notes point to a different SAP Note, 3476549, which could not be checked (login) and was not found on SAP's public 2024 Patch Day pages; it may be a later note or KBA about this CVE. CVSS 7.7 is SAP's own score from the 2017 Patch Day list (CISA-ADP gives 7.5).
Related
No related incidents.