CVE-2025-42986CWE-862

Missing Authorization check in SAP NetWeaver and ABAP Platform

Medium · published July 8, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-07-08T00:38Z
EPSS history
Timeline
  • 08 JUL 00:38Z
    Missing Authorization check in SAP NetWeaver and ABAP Platform
    cvelistv5