What’s Vulnerable › Vulnerabilities

CVE-2025-42959: Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-08 · updated 2026-06-17
• Weakness: CWE-308

Description

An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation could result in complete system compromise, affecting confidentiality, integrity, and availability.

Affected products

• SAP SE SAP NetWeaver (ABAP Server) and ABAP Platform: SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750 (+10)

References

• https://me.sap.com/notes/3600846
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42959 or the next vulnerability affects your stack