by Kastro
Paper/Archive/CVE-2025-42963

CVE-2025-42963

SAP_SE SAP NetWeaver Application Server for Java (Log Viewer ) — Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer )

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 54.8.548 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected system. This results in a severe impact on the confidentiality, integrity, and availability of the application and host environment.

Affected

ProductAffectedFixed inSource
SAP NetWeaver Application Server for Java (Log Viewer )LMNWABASICAPPS 7.50–CNA

Scores by source

sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3621771refurl.sap/sapsecuritypatchday