SecurityFan score 20 · Tier C
Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)
The Brief
- SANS Internet Storm Center reported that attackers are searching honeypot data for SAP NetWeaver webshells.
- The report was published on 2026-11-09 as an InfoCON green alert.
- The source gives no CVE, affected versions, or patch information.
Why it matters
Searches for SAP NetWeaver webshells suggest attackers may be looking for existing compromises on internet-facing SAP systems, so teams running NetWeaver should consider checking their hosts.
Who’s affected
- Teams running SAP NetWeaver
- #sap
- #netweaver
- #webshell
- #honeypot
- #threat-intel
Just saw a new (to me) URL in our honeypot data today:
Timeline
SANS Internet Storm Center reports attackers searching honeypots for SAP NetWeaver webshells
SANS Internet Storm Center, InfoCON: green
Attackers Searching for SAP Netweaver Webshells, (Mon, Nov 9th)