What’s Vulnerable › Vulnerabilities
CVE-2025-42954: Denial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application)
- Severity: low (CVSS 2.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-08 · updated 2026-06-17
- Weakness: CWE-835
Description
SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected resource. This leads to low impact on availability of the application, there is no impact on confidentiality and integrity.
Affected products
- SAP_SE SAP NetWeaver Business Warehouse (CCAW application): DW4CORE 100, 200, 300, 400, SAP_BW 700, 701 (+14)
References
Get alerted when CVE-2025-42954 or the next vulnerability affects your stack