{"api_version":"1","generated_at":"2026-07-23T05:57:27+00:00","cve":"CVE-2016-9832","urls":{"html":"https://cve.report/CVE-2016-9832","api":"https://cve.report/api/cve/CVE-2016-9832.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-9832","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-9832"},"summary":{"title":"CVE-2016-9832","description":"PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS, as demonstrated by WEBGUI or Report.","state":"PUBLISHED","assigner":"mitre","published_at":"2016-12-10 02:59:24","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-74","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"9.9","severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://seclists.org/fulldisclosure/2016/Dec/33","name":"http://seclists.org/fulldisclosure/2016/Dec/33","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Full Disclosure: [ESNC-2041217] Critical Security Vulnerability in PwC ACE Software for SAP Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html","name":"http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"PwC ACE Software For SAP Security 8.10.304 ABAP Injection ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security","name":"https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"],"title":"Security Advisories | Critical Security Vulnerability in PwC Ace","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/539883/30/0/threaded","name":"http://www.securityfocus.com/archive/1/539883/30/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/539883/100/0/threaded","name":"http://www.securityfocus.com/archive/1/539883/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/94733","name":"http://www.securityfocus.com/bid/94733","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"PwC ACE-ABAP CVE-2016-9832 Remote Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9832","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9832","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"9832","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"pwc","cpe5":"ace-advanced_business_application_programming","cpe6":"8.10.304","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2016","cve_id":"9832","cve":"CVE-2016-9832","epss":"0.072600000","percentile":"0.916850000","score_date":"2026-05-10","updated_at":"2026-05-11 00:14:42"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T02:59:03.546Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.securityfocus.com/archive/1/539883/30/0/threaded"},{"name":"94733","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/94733"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html"},{"name":"20161209 [ESNC-2041217] Critical Security Vulnerability in PwC ACE Software for SAP Security","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2016/Dec/33"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security"},{"name":"20161207 [ESNC-2041217] Critical Security Vulnerability in PwC ACE Software for SAP Security","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/539883/100/0/threaded"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-12-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS, as demonstrated by WEBGUI or Report."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-09T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://www.securityfocus.com/archive/1/539883/30/0/threaded"},{"name":"94733","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/94733"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html"},{"name":"20161209 [ESNC-2041217] Critical Security Vulnerability in PwC ACE Software for SAP Security","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2016/Dec/33"},{"tags":["x_refsource_MISC"],"url":"https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security"},{"name":"20161207 [ESNC-2041217] Critical Security Vulnerability in PwC ACE Software for SAP Security","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/539883/100/0/threaded"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2016-9832","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS, as demonstrated by WEBGUI or Report."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.securityfocus.com/archive/1/539883/30/0/threaded","refsource":"MISC","url":"http://www.securityfocus.com/archive/1/539883/30/0/threaded"},{"name":"94733","refsource":"BID","url":"http://www.securityfocus.com/bid/94733"},{"name":"http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html"},{"name":"20161209 [ESNC-2041217] Critical Security Vulnerability in PwC ACE Software for SAP Security","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2016/Dec/33"},{"name":"https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security","refsource":"MISC","url":"https://www.esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security"},{"name":"20161207 [ESNC-2041217] Critical Security Vulnerability in PwC ACE Software for SAP Security","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/539883/100/0/threaded"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2016-9832","datePublished":"2016-12-09T11:00:00.000Z","dateReserved":"2016-12-05T00:00:00.000Z","dateUpdated":"2024-08-06T02:59:03.546Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-12-10 02:59:24","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-74","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pwc:ace-advanced_business_application_programming:8.10.304:*:*:*:*:*:*:*","matchCriteriaId":"A298AD59-4DE3-4946-B8DF-9F276D31EAAC"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"9832","Ordinal":"1","Title":"CVE-2016-9832","CVE":"CVE-2016-9832","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"9832","Ordinal":"1","NoteData":"PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS, as demonstrated by WEBGUI or Report.","Type":"Description","Title":"CVE-2016-9832"},{"CveYear":"2016","CveId":"9832","Ordinal":"2","NoteData":"2016-12-09","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"9832","Ordinal":"3","NoteData":"2018-10-09","Type":"Other","Title":"Modified"}]}}}