CVE-2025-42966 — Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)

CVE-2025-42966

Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service) PUBLISHED

Description (CNA)

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver (XML Data Archiving Service)	affected J2EE-APPS 7.50

CWE

CWE-502

References

https://me.sap.com/notes/3610892
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.