Dashboard / CVE-2025-42989

CVE-2025-42989

CRITICAL
INFO Priority: 0.04 BB Relevance: 69/100
Published: 2025-06-10 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Changed
C: None
I: High
A: High

Description

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
SAP_SE SAP NetWeaver Application Server for ABAP KERNEL 7.89
SAP_SE SAP NetWeaver Application Server for ABAP 7.93
SAP_SE SAP NetWeaver Application Server for ABAP 9.14
SAP_SE SAP NetWeaver Application Server for ABAP 9.15

References & Advisories (2)

Bug Bounty Relevance

69 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

9.6 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

EPSS — Exploitation Probability

0.44%
Raw Score 0.004410
Percentile 38.4%
Date 2026-11-03

Intelligence Sources

mitre ref →

External Links