Yes. CISA added CVE-2021-38163 to its Known Exploited Vulnerabilities catalogue on 9 June 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. SAP NetWeaver contains a vulnerability that allows unrestricted file upload. Any organisation running the affected product should treat remediation as urgent.
What “exploited in the wild” means for this CVE
For a CVE like this, “in the wild” is not a vague label. It means the vulnerability has moved beyond proof-of-concept interest and is being used against real systems, which is why CISA’s KEV catalogue matters. For current prioritisation, pair the KEV entry with vendor guidance and confirm whether the vulnerable SAP NetWeaver service is exposed anywhere in your environment.
That distinction matters because unrestricted file upload flaws are often operationally simple to weaponise. Even when the initial path looks narrow, upload handling can become a foothold for web shells, follow-on access, or staging activity if the application accepts attacker-controlled content and stores it where it can later execute or be retrieved.
Confirming exposure is the first decision point: if you run SAP NetWeaver, inventory every reachable instance, then identify any component that accepts uploads, stores user-supplied files, or sits behind internet-facing access paths. For SAP-specific hardening and adjacent identity and access considerations, SAP Identity and Access Security Guide is useful context, while the File Upload Security Guide explains the control failures behind unrestricted upload.
Why unrestricted file upload is a practical compromise path
The security issue is not just “an upload bug.” Unrestricted upload can let an attacker place content the application should never trust, including executable files, script content, or files that later become reachable through the web tier. If the uploaded object is processed by another component, the flaw can also become a route to command execution, credential harvesting, or internal pivoting.
In practice, the exploit value depends on how the application stores, names, validates, and serves uploaded content. Weak file-type checks, permissive storage locations, or predictable URL paths can turn a single request into persistent access. That is why upload flaws are often treated as urgent even before defenders can prove active abuse on their own systems.
For general vulnerability triage, CISA Known Exploited Vulnerabilities Catalog is the operational signal that exploitation is real, and FIRST EPSS helps you compare urgency across other exposure candidates when patch queues are crowded.
How to respond before and after remediation
Start by verifying the exact SAP NetWeaver deployment, then apply the vendor fix or mitigation path referenced in the product advisory and CISA KEV entry. If patching must wait, reduce exposure by restricting access, removing internet reachability where possible, and disabling or tightly controlling the affected upload functionality until the fix is in place.
Do not stop at patching. If the system was reachable before remediation, check for signs of file placement, unusual web content, new binaries, suspicious timestamps, or unexpected outbound traffic from the host. Where upload abuse could have enabled follow-on access, review authentication events and service activity for lateral movement or persistence attempts, because the upload itself may only be the first stage of compromise.
For a broader control view, Vulnerability Management Guide supports the triage and verification workflow, and NIST National Vulnerability Database remains the reference point for the CVE record and related metadata.
Risk and Threat Considerations
An exploited upload flaw matters because it can convert a routine application weakness into durable access. Once an attacker can place content on a NetWeaver host, the main risk is not only the initial upload, but the downstream opportunity to stage malware, create a web-accessible foothold, or use the application as a pivot into adjacent systems.
Failure mechanism: The application accepts attacker-controlled files without sufficient validation, isolation, or serving restrictions, allowing malicious content to persist and become reachable or executable.
Impact: The likely outcomes include host compromise, follow-on credential theft, internal reconnaissance, and a materially larger blast radius if the server is trusted by other systems or users.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Actively exploited CVEs require rapid identification, prioritization, and remediation. |
| Recommendation — Prioritize and remediate the KEV-listed SAP NetWeaver flaw using continuous vulnerability management. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | The question is about confirming and responding to a known exploited vulnerability. |
| SI-10 — Information Input Validation | Unrestricted file upload is fundamentally an input-validation failure. | |
| Recommendation — Use RA-5 to verify exposure and track remediation until the vulnerable SAP service is cleared. Apply SI-10 to validate file type, content, and handling before uploads are accepted. | ||
| OWASP ASVS | V5 — File Handling | The vulnerability is an unrestricted file upload issue in web application file handling. |
| V15 — Secure Coding and Architecture | Safe upload design depends on architecture that isolates untrusted files from execution paths. | |
| Recommendation — Use V5 to enforce safe file upload handling, storage, and access restrictions. Apply V15 to isolate uploaded content from executable application paths. | ||
Practitioner Guidance
What to prioritise: Treat this as an exposure-management problem first, not just a patch ticket. Confirm whether any SAP NetWeaver instance is reachable from untrusted networks, then decide whether immediate isolation is needed before business-hours patching is possible.
What to verify: Validate that the vulnerable component is actually present, that the fix or mitigation has been applied, and that uploaded content cannot be executed, referenced, or repurposed through another route. If the application team cannot prove that file handling is constrained, assume the control is weaker than intended.
Practitioner takeaway: For actively exploited CVEs, remediation urgency should be driven by exposure and exploitability, not by waiting for local evidence of compromise. If the system can still accept untrusted uploads, you should assume the attack path remains viable until the control is removed or hardened.
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- How do you patch or mitigate CVE-2021-38163 (SAP NetWeaver Unrestricted File Upload)?
- Is CVE-2025-31324 (SAP NetWeaver Unrestricted File Upload) being exploited in the wild?
- CVE-2021-38163 (SAP NetWeaver Unrestricted File Upload)
- Is CVE-2021-20022 (SonicWall Email Security Unrestricted Upload of File) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org