CVE-2025-42955: Missing authorization check in SAP Cloud Connector

Severity: low (CVSS 3.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-12 · updated 2026-06-17
Weakness: CWE-862

Description

Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted request to the endpoint responsible for testing LDAP connections. A successful exploit could lead to reduced performance, hence a low-impact on availability of the service. Confidentiality and integrity of the data are not affected.

Affected products

SAP SE SAP Cloud Connector: SAP_CLOUD_CONNECTOR 2.0

References

https://me.sap.com/notes/3611345
https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42955 or the next vulnerability affects your stack