VulnerabilityDeferred

CVE-2025-42878

SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production.

HIGH 8.2EPSS 0.36%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.

CVSS 3.1: 8.2 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H
EPSS: 0.36% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-1244
Source: cna@sap.com

References

https://me.sap.com/notes/3684682
https://url.sap/sapsecuritypatchday

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.