CVE-2013-1592: A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when...

Security readout for executives and security teams

This CVE describes a buffer overflow in SAP NetWeaver Message Server. A remote attacker could send specially crafted packets to SAP Message Server ports and potentially run arbitrary code. For organizations running the listed SAP NetWeaver versions, exposure is most serious where those ports are reachable from untrusted networks. Exposure is likely limited to organizations running the affected SAP NetWeaver releases with Message Server reachable on TCP 36NN or 39NN. Internet, partner-network, or broadly internal reachability raises risk materially. Treat this as high priority for any exposed SAP NetWeaver environment. Although active exploitation is not confirmed in the supplied sources, the potential impact is remote code execution against a core enterprise system and public exploit references exist. Mitigation focus: Check current SAP vendor guidance and SAP Notes for the affected NetWeaver versions.; Patch or upgrade affected SAP NetWeaver systems where vendor guidance confirms remediation.; Restrict TCP 36NN and 39NN to trusted SAP hosts only..

Prepared

Jun 6, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.