Critical SAP NetWeaver Command Execution Vulnerability: Maximum Severity Fixes Available
SAP has recently addressed 21 new vulnerabilities affecting its products, including three critical severity issues impacting the NetWeaver software solution. SAP NetWeaver serves as the foundation for various SAP business applications such as ERP, CRM, SRM, and SCM, functioning as a modular middleware widely deployed in large enterprise networks. In its September security bulletin, SAP identified a vulnerability with a maximum severity score of 10 out of 10, labelled CVE-2025-42944. This issue pertains to an insecure deserialization vulnerability in SAP NetWeaver (RMIP4), ServerCore 7.50. An unauthenticated attacker could exploit this flaw to execute arbitrary OS commands by sending a malicious Java object through the RMI-P4 module to an open port. Although the P4 port is open on the host, misconfigurations may inadvertently expose it to broader networks or the internet.
Additionally, SAP fixed another critical flaw, CVE-2025-42922, with a CVSS v3.1 score of 9.9, which involves insecure file operations in NetWeaver AS Java (Deploy Web Service), J2EE-APPS 7.50. This vulnerability allows an attacker with non-administrative authenticated access to upload arbitrary files, potentially leading to full system compromise. The third critical flaw, CVE-2025-42958, features a missing authentication check in NetWeaver, enabling unauthorized high-privileged users to read, modify, or delete sensitive data. SAP also addressed several high-severity flaws, including CVE-2025-42933, CVE-2025-42929, and CVE-2025-42916, which pose risks related to insecure data storage and input validation. System administrators are advised to follow the patching and mitigation recommendations for these critical flaws, as SAP products are often targeted by threat actors seeking high-value compromises.
Categories: Vulnerabilities, SAP NetWeaver, Security Flaws
Tags: SAP, Vulnerabilities, NetWeaver, CVE-2025-42944, Insecure Deserialization, RMI-P4, Authentication, Exploit, Security Bulletin, Patching