VulnerabilityDeferred

CVE-2025-42953

SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

HIGH 8.1EPSS 0.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could completely compromise the integrity and availability with no impact on confidentiality of the system.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS: 0.45% probability · 38th percentile
CISA KEV: Not listed
Weakness: CWE-862
Source: cna@sap.com

References

https://me.sap.com/notes/3623440
https://url.sap/sapsecuritypatchday

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.