What’s Vulnerable › Vulnerabilities
CVE-2025-42949: Missing Authorization check in ABAP Platform
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-12 · updated 2026-06-17
- Weakness: CWE-862
Description
Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected.
Affected products
- SAP_SE SAP ABAP Platform: SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 916
References
Get alerted when CVE-2025-42949 or the next vulnerability affects your stack