cbcvebase.
CVE-2025-42878
published 2025-12-09

CVE-2025-42878: SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit…

PriorityP348high8.2CVSS 3.1
AVNACHPRNUIRSCCHILAH
EPSS
0.31%
22.4th percentile
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.

Affected

11 ranges
VendorProductVersion rangeFixed in
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
sap_sesap_web_dispatcher_and_internet_communication_manager——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.