CVE-2025-42986

CWE-862 — Missing Authorization3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 83.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Netweaver AND Abap PlatformSAP SAP Basis
Timeline
PublishedJul 8

Description

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDsap/sap_basis10 versions+9

Patches

Patch: url.sap ↗

🔴Vulnerability Details

2
GHSA
GHSA-mjjf-m9pr-358v: Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Re↗2025-07-08
▶
CVEList
Missing Authorization check in SAP NetWeaver and ABAP Platform↗2025-07-08
▶
CVE-2025-42986 (MEDIUM CVSS 4.3) | Due to a missing authorization chec | cvebase.io