CVE-2025-42989

9.6 criticalEPSS 0.4%

Critical (9.6). EPSS 0.4% chance of exploitation in the next 30 days.

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application.

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2025-06-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://me.sap.com/notes/3600840
https://url.sap/sapsecuritypatchday

Check your stack JSON