CVE-2025-42989 — Missing Authorization check in SAP NetWeaver Application Server for ABAP

CVE-2025-42989

Missing Authorization check in SAP NetWeaver Application Server for ABAP PUBLISHED

Description (CNA)

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP NetWeaver Application Server for ABAP	affected KERNEL 7.89; affected 7.93; affected 9.14; affected 9.15

CWE

CWE-862

References

https://me.sap.com/notes/3600840
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.