What’s Vulnerable › Vulnerabilities
CVE-2025-42891: Missing Authorization check in SAP Enterprise Search for ABAP
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-09 · updated 2026-10-07
- Weakness: CWE-862
Description
Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of database tables into an ABAP report. This could lead to a high impact on data confidentiality and a low impact on data integrity. There is no impact on application's availability.
Affected products
- SAP_SE SAP Enterprise Search for ABAP: SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757 (+2)
References
Get alerted when CVE-2025-42891 or the next vulnerability affects your stack