What’s Vulnerable › Vulnerabilities
CVE-2025-42936: Missing Authorization check in SAP NetWeaver Application Server for ABAP
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-12 · updated 2026-06-17
- Weakness: CWE-266
Description
The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.
Affected products
- SAP_SE SAP Business Workflow: 700, 701, 702, 731, 740, 750 (+9)
References
Get alerted when CVE-2025-42936 or the next vulnerability affects your stack