by Kastro
Paper/Archive/CVE-2025-42958

CVE-2025-42958

SAP_SE SAP NetWeaver — Missing Authentication check in SAP NetWeaver

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 53.6.536 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. This results in a high impact on the confidentiality, integrity, and availability of the application.

Affected

ProductAffectedFixed inSource
SAP NetWeaverKRNL64NUC 7.22–CNA
SAP NetWeaver7.22EXT–CNA
SAP NetWeaverKRNL64UC 7.22–CNA
SAP NetWeaver7.53–CNA
SAP NetWeaverKERNEL 7.22–CNA
SAP NetWeaver7.54–CNA

Scores by source

sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3627373refurl.sap/sapsecuritypatchday