What’s Vulnerable › Vulnerabilities

CVE-2025-23186: Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

• Severity: high (CVSS 8.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-08 · updated 2026-06-17
• Weakness: CWE-94

Description

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.

Affected products

• SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54 (+3)

References

• https://me.sap.com/notes/3554667
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-23186 or the next vulnerability affects your stack