CVE-2025-42986 MEDIUM

CVE-2025-42986: Missing Authorization check in SAP NetWeaver and ABAP Platform

Vendor Sap_Se
Product SAP NetWeaver and ABAP Platform
Weakness CWE-862 · Missing authorization
Published July 8, 2025
Last update July 8, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.

Key dates

02Disclosure timeline

July 8, 2025 CVE published
July 8, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-68024 WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability CVE-2026-42651 WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerability CVE-2024-56070 WordPress WP SuperBackup plugin <= 2.3.3 - Multiple Subscriber+ Broken Access Control vulnerabilities CVE-2025-3058 Xelion Webchat <= 9.1.0 - Authenticated (Subscriber+) Arbitrary Options Update CVE-2024-13423 Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation