Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)

2026-11-10T01:23:41Z•72c17c3935b80fbe264ba814c8fe7baa9e88a8b3c352e7f9172c4259d170bfe5

CVE-2000-0411CVE-2023-20198CVE-2026-123158CVE-2026-98432Cisco-IOSLinuxMultipath-TCPSAP-NetWeaverSSHemail-scriptsexploit-attemptshoneypotlegacy-CGIvulnerability-scanningwebshell

Open source link →

What happened

SANS Internet Storm Center entries report active internet scanning and exploitation attempts targeting SAP NetWeaver webshells, the newly disclosed SSH “sshole” vulnerability (CVE-2026-123158), older Cisco IOS exposure likely related to CVE-2023-20198, legacy vulnerable email CGI scripts including CVE-2000-0411, and a Linux Multipath TCP vulnerability (CVE-2026-98432). The feed primarily reflects honeypot observations and vulnerability awareness rather than confirmed compromise.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: sans_isc_diary
Record identifier: 72c17c3935b80fbe264ba814c8fe7baa9e88a8b3c352e7f9172c4259d170bfe5
Enrichment time: 2026-11-10T01:23:41Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records