Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)
2026-11-09T19:23:46Z•bf2587d5275185bfce16abc4b2aa1a70b4729a87ee134f8b1b0a0e643848b69b
CVE-2000-0411CVE-2023-20198CVE-2026-123158CVE-2026-98432Cisco-IOSLinuxMultipath-TCPSAP-NetWeaverSSHemail-scriptexploitation-attemptshoneypotlegacy-CGIthreat-intelligencevulnerability-scanningwebshell
What happened
SANS Internet Storm Center entries report ongoing opportunistic scanning and exploitation activity, including SAP NetWeaver webshell discovery, exploitation attempts targeting the SSH “sshole” vulnerability (CVE-2026-123158), suspected exploitation of Cisco IOS CVE-2023-20198, legacy vulnerable email CGI scripts including CVE-2000-0411, and discussion of a Linux Multipath TCP vulnerability (CVE-2026-98432). The feed primarily reflects honeypot observations and vulnerability awareness rather than a single confirmed incident.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- bf2587d5275185bfce16abc4b2aa1a70b4729a87ee134f8b1b0a0e643848b69b
- Enrichment time
- 2026-11-09T19:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.