What’s Vulnerable › Vulnerabilities

CVE-2025-42963: Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer )

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-08 · updated 2026-06-17
• Weakness: CWE-502

Description

A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected system. This results in a severe impact on the confidentiality, integrity, and availability of the application and host environment.

Affected products

• SAP_SE SAP NetWeaver Application Server for Java (Log Viewer ): LMNWABASICAPPS 7.50

References

• https://me.sap.com/notes/3621771
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42963 or the next vulnerability affects your stack