by Kastro
Paper/Archive/CVE-2025-42944

CVE-2025-42944

SAP_SE SAP Netweaver (RMI-P4) — Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)

EPSS 3%CVSS 10.0
critical.is priorityof 100
48
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 87.3.873 × 2017.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability.

Affected

ProductAffectedFixed inSource
SAP Netweaver (RMI-P4)SERVERCORE 7.50–CNA

Scores by source

sap (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refme.sap.com/notes/3670067refme.sap.com/notes/3660659refme.sap.com/notes/3634501refurl.sap/sapsecuritypatchday