New SAP NetWeaver Vulnerabilities Allow Attackers to Bypass Authorization and Execute OS Commands
On SAP's Security Patch Day for October 2025, a total of 13 new vulnerabilities were addressed, alongside updates to four previous security notes. Notably, several critical vulnerabilities in SAP NetWeaver were identified, which could permit unauthorized…
On SAP's Security Patch Day for October 2025, a total of 13 new vulnerabilities were addressed, alongside updates to four previous security notes. Notably, several critical vulnerabilities in SAP NetWeaver were identified, which could permit unauthorized execution of arbitrary operating system commands.
Critical Vulnerability in SAP NetWeaver
The most severe issue is CVE-2025-42944, which involves insecure deserialization in the SAP NetWeaver AS Java's RMI-P4 module. This vulnerability carries a CVSS score of 10.0, indicating the potential for unauthenticated remote attackers to gain full control without credentials.
First addressed in September, the vulnerability highlights ongoing risks to SAP environments, which are crucial for global business operations, potentially leading to data breaches or complete system compromise.
The vulnerability arises from improper handling of serialized Java objects via the RMI-P4 protocol. Insufficient validation allows malicious payloads to be executed directly on servers, bypassing authentication checks and operating with elevated privileges.
Onapsis Research Labs collaborated with SAP to mitigate this risk, noting that exploitation does not require user interaction, thereby compromising confidentiality, integrity, and availability across SAP systems.
On SAP's Security Patch Day for October 2025, a total of 13 new vulnerabilities were addressed, alongside updates to four previous security notes.
Affected versions include SERVERCORE 7.50. Although no public proof-of-concept currently exists, the vulnerability's simplicity makes it a likely target for attackers.
SAP's October update for notes 3660659 and 3634501 introduces a JVM-wide filter (jdk.serialFilter) to block unsafe class deserialization. This update divides protections into mandatory and optional lists aimed at preventing code execution exploits.
Additional vulnerabilities, such as CVE-2025-31331, involve authorization bypasses in older NetWeaver versions, enabling unauthorized command injection. Another update, note 3441087, addresses missing checks in SAP S/4HANA's purchase contract management.
CVE-2025-42944: Critical deserialization flaw in SAP NetWeaver AS Java. CVE-2025-42937: Directory traversal in SAP Print Service. CVE-2025-42910: File upload vulnerability in Supplier Relationship Management. Other vulnerabilities affect various SAP products, including SAP Commerce Cloud and SAP Data Hub Integration Suite.
Security firms recommend immediate patching and reinforcing multi-layered defenses to counter increasing exploits in SAP systems. SAP advises customers to apply these updates via the Support Portal to protect mission-critical applications from evolving threats.
Based on reporting by Cyber Security News.