What’s Vulnerable › Vulnerabilities

CVE-2025-42952: Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-08 · updated 2026-06-17
• Weakness: CWE-862

Description

SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially rendering the system unusable. On successful exploitation, an attacker can render the system unusable by triggering short dumps on login. This could cause a high impact on availability. Data confidentiality and integrity are not affected. No data can be read, changed or deleted.

Affected products

• SAP_SE SAP Business Warehouse and SAP Plug-In Basis: PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 700 (+10)

References

• https://me.sap.com/notes/3623255
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42952 or the next vulnerability affects your stack