CVE-2025-42925: Predictable from Observable State

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

CVE-2025-42938: Improper Neutralization of Input During Web Page Generation

Due to a Cross-Site Scripting XSS vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation,...

CVE-2025-42926: Missing Authentication for Critical Function

SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the...

CVE-2025-42958: Execution with Unnecessary Privileges

Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. This results in a high impact on the...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products, including in SAP NetWeaver Application Server ABAP, SAP S/4HANA, SAP Landscape Transformation and AP Cloud Connector. The vulnerabilities include circumvention of authorization controls, Cross-Site Scripting XSS and a Directory Traversal...

The vulnerability of the content-sharing framework between corporate portals in the SAP NetWeaver Enterprise Portal and Federated Portal Network is related to deficiencies in the deserialization mechanism. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the content-sharing framework between corporate portals of SAP NetWeaver Enterprise Portal and Federated Portal Network is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity,...

The vulnerability of SAP NetWeaver Application Server Java, related to deserialization mechanism flaws, allows attackers to completely compromise the system.

The vulnerability of SAP NetWeaver Application Server Java is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to completely compromise the system remotely...

The vulnerability of the administrative module for managing the SAP NetWeaver Enterprise Portal Administration, related to deficiencies in deserialization mechanisms, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the administrative module for managing the SAP NetWeaver Enterprise Portal Administration is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability of SAP NetWeaver Application Server Java, related to insufficient verification of communication source, allows attackers to disclose protected information.

The vulnerability of SAP NetWeaver Application Server Java is related to insufficient checks on the source of the communication channel. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of the software for developing and executing applications in the ABAP language of SAP NetWeaver Application Server ABAP lies in the lack of authentication mechanisms. This allows attackers to compromise the confidentiality of protected information.

The vulnerability of the software used for developing and executing applications in the ABAP language of SAP NetWeaver Application Server is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to potentially compromise the confidentiality of protected...

The vulnerability of the software for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP lies in the absence of an authentication procedure, which allows attackers to escalate their privileges.

The vulnerability of the software used for developing and executing applications in the ABAP language of SAP NetWeaver Application Server is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to increase their privileges remotely...

The vulnerability of SAP NetWeaver ABAP Server and ABAP Platform software integration platforms, related to the use of single-factor authentication, allows attackers to completely compromise the system.

The vulnerability of SAP NetWeaver ABAP Server and ABAP Platform integration platforms is related to the use of single-factor authentication. Exploiting this vulnerability allows a malicious actor to completely compromise the system from a remote location...

The vulnerability of the SAP NetWeaver software integration platform, related to the lack of authentication, allows a perpetrator to compromise the confidentiality of protected information.

The vulnerability of the SAP NetWeaver software integration platform is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to remotely influence the confidentiality of the protected information...

The vulnerability of SAP NetWeaver and ABAP Platform software integration platforms, related to the absence of authentication, allows attackers to compromise the confidentiality of protected information.

The vulnerability of SAP NetWeaver and ABAP Platform software integration platforms is related to the absence of authentication. Exploiting this vulnerability allows a malicious actor to remotely compromise the confidentiality of protected information...

The vulnerability of the SAP NetWeaver software integration platform, related to deficiencies in the deserialization mechanism, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SAP NetWeaver software integration platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerabilities in the software for developing and executing applications in the ABAP language of SAP NetWeaver Application Server ABAP (BIC Document) allow attackers to carry out cross-site scripting attacks and gain unauthorized access to protected information.

The vulnerability of the software used for developing and executing applications in the ABAP language of SAP NetWeaver Application Server ABAP BIC Document is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform...

The Bug Report – August 2025 Edition

The Bug Report – August 2025 Edition By Jonathan Omakun, Tola Olawale · August 27, 2025 Why am I here? Welcome back to The Bug Report! Did you miss us? The Trellix Advanced Research Center has been playing a high-stakes game of whack-a-mole with this month's vulnerabilities. We've dug through all...

SAP NetWeaver AS ABAP Privileges Escalation (3623440)

The remote SAP NetWeaver ABAP server is affected by priviliege escalation. vulnerability as referenced in the 3623440 advisory. - SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. CVE-2025-42953 Not...

Public Exploit for Chained SAP Flaws Exposes Unpatched Systems to Remote Code Execution

A new exploit combining two critical, now-patched security flaws in SAP NetWeaver has emerged in the wild, putting organizations at risk of system compromise and data theft. The exploit in question chains together CVE-2025-31324 and CVE-2025-42999 to bypass authentication and achieve remote code...

Public Exploit for Chained SAP Flaws Exposes Unpatched Systems to Remote Code Execution

A new exploit combining two critical, now-patched security flaws in SAP NetWeaver has emerged in the wild, putting organizations at risk of system compromise and data theft. The exploit in question chains together CVE-2025-31324 and CVE-2025-42999 to bypass authentication and achieve remote code...