What’s Vulnerable › Vulnerabilities

CVE-2025-42950: Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-12 · updated 2026-06-17
• Weakness: CWE-94

Description

SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Affected products

• SAP_SE SAP Landscape Transformation (Analysis Platform): DMIS 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020

References

• https://me.sap.com/notes/3633838
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42950 or the next vulnerability affects your stack