What’s Vulnerable › Vulnerabilities
CVE-2025-42982: Information Disclosure in SAP GRC (AC Plugin)
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-06-10 · updated 2026-06-17
- Weakness: CWE-862
Description
SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials. This causes high impact on confidentiality, integrity and availability of the application.
Affected products
- SAP_SE SAP GRC (AC Plugin): GRCPINW V1100_700, V1100_731
References
Get alerted when CVE-2025-42982 or the next vulnerability affects your stack