by Kastro
Paper/Archive/CVE-2025-0070

CVE-2025-0070

SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform — Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform

EPSS 0.7%CVSS 9.9
critical.is priorityof 100
40
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 53.1.531 × 2010.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.

Affected

ProductAffectedFixed inSource
SAP NetWeaver Application Server for ABAP and ABAP PlatformKRNL64NUC 7.22–CNA
SAP NetWeaver Application Server for ABAP and ABAP Platform7.22EXT–CNA
SAP NetWeaver Application Server for ABAP and ABAP PlatformKRNL64UC 7.22–CNA
SAP NetWeaver Application Server for ABAP and ABAP Platform7.53–CNA
SAP NetWeaver Application Server for ABAP and ABAP Platform8.04–CNA
SAP NetWeaver Application Server for ABAP and ABAP PlatformKERNEL 7.22–CNA
SAP NetWeaver Application Server for ABAP and ABAP Platform7.54–CNA
SAP NetWeaver Application Server for ABAP and ABAP Platform7.77–CNA
SAP NetWeaver Application Server for ABAP and ABAP Platform7.89–CNA
SAP NetWeaver Application Server for ABAP and ABAP Platform7.93–CNA
SAP NetWeaver Application Server for ABAP and ABAP Platform7.97–CNA
SAP NetWeaver Application Server for ABAP and ABAP Platform9.12–CNA

Scores by source

sap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3537476refurl.sap/sapsecuritypatchday