SANS Internet Storm Center honeypots detect SAP NetWeaver webshell scanning

SANS Internet Storm Center observed the URL /irj/servlet_jsp/irj/root/ant.jsp in its honeypot data on Nov. 9, 2026.

The activity is part of a wider campaign to compromise SAP NetWeaver or locate webshells—malicious scripts planted on a server for remote control—already present on systems, Johannes B. Ullrich, Ph.D., dean of research at SANS.edu, said. “This request is part of a larger campaign to exploit SAP NetWeaver or to find already installed webshells,” Ullrich said.

The exploitation centers on CVE-2025-31324, which carries a CVSS score of 10 and permits unauthenticated file uploads. Attackers have used the flaw to upload webshells, which typically appear in /irj/servlet_jsp/irj/root/. The attacker IP address 82.26.72.21 is hitting multiple URLs, though not all relate to SAP NetWeaver, and one URL contains a misspelling of upload.aspx.

SAP’s July 14, 2026, security updates fixed 16 vulnerabilities across several products, including critical flaws in NetWeaver, Commerce Cloud and AppRouter. CVE-2026-44747 is a memory corruption flaw in NetWeaver Application Server ABAP caused by an out-of-bounds write weakness. An authenticated attacker can exploit logical errors in memory management to cause memory corruption and gain unauthorized data access, modification or system unavailability. “This has high impact on confidentiality, integrity, and availability of the application,” the company said.

SAP rates the effect on confidentiality, integrity and availability for the application as high. Its July advisory covered six high-severity flaws, seven medium-severity flaws and one low-severity flaw, including DLL hijacking, open redirects, missing authorization checks, remote code execution, cross-site scripting, path traversal, SQL injection, denial of service, information disclosure and security misconfigurations. The company said it found no evidence the patched July vulnerabilities were exploited in attacks.

SAP’s July updates also addressed CVE-2026-27690, an HTTP Request Smuggling flaw in SAP Approuter, a Node.js-based middleware library for cloud apps on SAP BTP, through which unauthenticated attackers can cause denial-of-service conditions with specially crafted requests. CVE-2026-44761, a critical SAP Commerce Cloud flaw tied to default credentials, lets attackers obtain valid access tokens and read or change data through specific APIs.

CISA has placed 14 SAP security flaws in its Known Exploited Vulnerabilities catalog starting in November 2021, two of them abused by ransomware gangs. SAP fixed 15 vulnerabilities in its June 2026 Security Patch package.

Multiple official SAP npm packages were compromised in a supply chain attack intended to steal credentials from developers’ systems. SAP reported total revenues exceeding €36 billion for fiscal year 2025 and serves 99 of the 100 largest companies worldwide.