CVE-2025-42882: Missing Authorization

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system...

PT-2025-46238

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java affected versions not specified Description An information disclosure issue exists in SAP NetWeaver Application Server Java. An unauthenticated attacker can access internal metadata files through crafted...

CVE-2025-42919: Improper Limitation of a Pathname to a Restricted Directory

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...

SAP NetWeaver AS ABAP Multiple Vulnerabilities (October 2025)

The version of SAP NetWeaver Application Server for ABAP detected on the remote host is affected by multiple vulnerabilities as disclosed in the SAP Security Patch Day October 2025: - Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacke...

SAP NetWeaver AS Java Insecure Deserialization (October 2025)

The version of SAP NetWeaver Application Server for Java detected on the remote host is affected by an insecure deserialization vulnerability as disclosed in the SAP Security Patch Day October 2025: - Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could explo...

New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login

SAP has rolled out security fixes for 13 new security issues, including additional hardening for a maximum-severity bug in SAP NetWeaver AS Java that could result in arbitrary command execution. The vulnerability, tracked as CVE-2025-42944, carries a CVSS score of 10.0. It has been described as a...

New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login

SAP has rolled out security fixes for 13 new security issues, including additional hardening for a maximum-severity bug in SAP NetWeaver AS Java that could result in arbitrary command execution. The vulnerability, tracked as CVE-2025-42944, carries a CVSS score of 10.0. It has been described as a...

CVE-2025-42902

Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it h...

CVE-2025-42908

Due to a Cross-Site Request Forgery CSRF vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allo...

The vulnerability of SAP NetWeaver Application Server ABAP and ABAP Platform software integration platforms, related to deficiencies in authentication procedures, allows attackers to compromise the confidentiality of protected information.

The vulnerability of SAP NetWeaver Application Server ABAP and ABAP Platform software integration platforms is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality of protected information...

The vulnerability of the functional module of the RFC interface in SAP NetWeaver Application Server ABAP and ABAP Platform allows attackers to compromise the confidentiality of protected information.

The vulnerability of the functional module of the RFC interface in SAP NetWeaver Application Server ABAP and ABAP Platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to compromise the confidentiality of the protected information...

The vulnerability of SAP NetWeaver AS Java software integration platforms, related to the unencrypted storage of critical information, allows attackers to disclose protected data.

The vulnerability of SAP NetWeaver AS Java software-based integration platforms lies in the unencrypted storage of critical information. Exploiting this vulnerability can allow attackers to disclose the protected data...

CVE-2025-42908

Due to a Cross-Site Request Forgery CSRF vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allo...

CVE-2025-42908 Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP

Due to a Cross-Site Request Forgery CSRF vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allo...

EUVD-2025-34122

Due to a Cross-Site Request Forgery CSRF vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allo...

CVE-2025-42908 Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP

Due to a Cross-Site Request Forgery CSRF vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allo...

CVE-2025-42908

CVE-2025-42908 describes a CSRF vulnerability in SAP NetWeaver Application Server for ABAP where an authenticated attacker can initiate transactions via the session manager, bypassing the initial transaction screen and authorization check, potentially enabling actions that normally require specif...

CVE-2025-42902 Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform

Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it h...

EUVD-2025-34125

Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it h...

CVE-2025-42902 Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform

Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it h...