SAP released security updates on Tuesday to fix multiple flaws, including three critical vulnerabilities in SAP NetWeaver that enable code execution and arbitrary file uploads.
The vulnerabilities include:
- CVE-2025-42944 (CVSS score: 10.0) – A deserialization flaw in SAP NetWeaver lets an unauthenticated attacker submit a malicious payload to an open port through the RMI-P4 module, which executes operating system commands.
- CVE-2025-42922 (CVSS score: 9.9) – An insecure file operations bug in SAP NetWeaver AS Java allows an attacker with non-administrative credentials to upload arbitrary files.
- CVE-2025-42958 (CVSS score: 9.1) – A missing authentication check in the SAP NetWeaver application on IBM i-series lets highly privileged unauthorized users read, modify, or delete sensitive information, and access administrative or privileged functions.
“[CVE-2025-42944] allows an unauthenticated attacker to execute arbitrary OS commands by submitting a malicious payload to an open port,” Onapsis said. “A successful exploit can lead to full compromise of the application. As a temporary workaround, customers should add P4 port filtering at the ICM level to prevent unknown hosts from connecting to the P4 port.”
In addition, SAP fixed a High-severity input Validation flaw in SAP S/4HANA (CVE-2025-42916, CVSS score: 8.1). This bug allows Attackers with High-privilege access to ABAP reports to delete Arbitrary database tables when the tables lack protection by an Authorization group.
These updates follow recent disclosures from SecurityBridge and Pathlock. The firms revealed that Attackers have already Exploited a critical SAP S/4HANA defect (CVE-2025-42957, CVSS score: 9.9) that SAP patched last month.
Although researchers have not found evidence of Exploitation for the newly Disclosed flaws, SAP users must apply the updates immediately to maintain strong protection.
Source: TheHackerNews
Read more at Impreza News
