by Kastro
Paper/Archive/CVE-2025-42928

CVE-2025-42928

SAP_SE SAP jConnect - SDK for ASE — Deserialization Vulnerability in SAP jConnect - SDK for ASE

EPSS 9%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 95.4.954 × 2019.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.

Affected

ProductAffectedFixed inSource
SAP jConnect - SDK for ASESYBASE_SOFTWARE_DEVELOPER_KIT 16.0.4–CNA
SAP jConnect - SDK for ASE16.1–CNA

Scores by source

sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3685286refurl.sap/sapsecuritypatchday