CVE-2025-42882: SAP NetWeaver ABAP Information Disclosure

CVE-2025-42882 Overview

CVE-2025-42882 is a missing authorization check in SAP NetWeaver Application Server for ABAP. An authenticated attacker with basic privileges can invoke a specific ABAP function module to retrieve restricted technical information about the system. The disclosed environment details help attackers plan follow-on attacks against the SAP landscape.

The flaw affects confidentiality only, with no integrity or availability impact. SAP addressed the issue in the November 2025 SAP Security Patch Day release via SAP Note #3643337.

Critical Impact
Authenticated users with basic privileges can extract restricted technical system information from SAP NetWeaver ABAP, enabling reconnaissance for subsequent targeted attacks.

Affected Products

SAP NetWeaver Application Server for ABAP
ABAP function module referenced in SAP Note #3643337
SAP systems relying on standard authorization checks for restricted function modules

Discovery Timeline

2025-11-11 - CVE-2025-42882 published to NVD as part of SAP Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42882

Vulnerability Analysis

The vulnerability is a missing authorization check [CWE-862] in SAP NetWeaver Application Server for ABAP. A specific function module fails to validate whether the calling user holds the required authorization object before returning restricted technical information.

An authenticated attacker with only basic SAP privileges can call the function module through standard remote or dialog interfaces. The server executes the module and returns environment details that should be limited to privileged administrators.

Exposed technical information can include system configuration, component versions, or runtime parameters. Attackers use this data to fingerprint the SAP landscape and identify weaker components to target next. The scope is unchanged, and no code execution or data modification occurs directly through this flaw.

Root Cause

The function module in question executes its business logic without invoking an AUTHORITY-CHECK statement or an equivalent authorization guard. ABAP developers are expected to enforce access control explicitly, since the runtime does not implicitly restrict function-module execution based on the returned data sensitivity. The absence of this check allows any authenticated principal to receive data intended for privileged roles.

Attack Vector

The attack is network-based and requires a valid SAP user account with basic privileges. An attacker authenticates to the NetWeaver ABAP system and invokes the vulnerable function module through Remote Function Call (RFC), a SAP GUI transaction, or another exposed interface that reaches the module. The server returns restricted technical details in the response, which the attacker collects for reconnaissance.

Refer to SAP Note #3643337 for the specific function-module identifier and technical details.

Detection Methods for CVE-2025-42882

Indicators of Compromise

Unusual RFC or dialog calls to the function module identified in SAP Note #3643337 originating from low-privileged user accounts.
Repeated function-module invocations from a single user session that return technical or environment metadata.
Access patterns from service or interface accounts that historically do not query system technical information.

Detection Strategies

Review SAP Security Audit Log (SM19/SM20) entries for calls to the affected function module by users lacking administrative authorizations.
Correlate RFC gateway logs with user role assignments to identify privilege mismatches on function-module execution.
Enable ABAP call monitoring for sensitive function modules to baseline expected callers and alert on deviations.

Monitoring Recommendations

Forward SAP audit and RFC logs to a centralized SIEM for correlation with identity and endpoint telemetry.
Track authentication anomalies for SAP accounts, especially basic-privilege users generating reconnaissance-style query patterns.
Alert on new or dormant accounts that begin enumerating SAP system information after long inactivity.

How to Mitigate CVE-2025-42882

Immediate Actions Required

Apply the SAP patch referenced in SAP Note #3643337 to all affected NetWeaver ABAP systems.
Audit user role assignments and remove unnecessary authorizations from basic-privilege accounts.
Review recent SAP Security Audit Log entries for prior invocations of the affected function module by non-privileged users.

Patch Information

SAP released the fix as part of the November 2025 SAP Security Patch Day. Administrators should implement the correction delivered in SAP Note #3643337 and consult the SAP Security Patch Day Announcement for the full advisory context and affected support-package levels.

Workarounds

Restrict RFC access to the affected function module using SAP Unified Connectivity (UCON) allow-lists until the patch is applied.
Limit network exposure of SAP RFC and dialog interfaces to trusted administrative segments.
Tighten role design so basic-privilege accounts cannot reach function modules that expose technical system data.

bash

# Example: review recent Security Audit Log entries for suspicious function-module calls
# Transaction SM20 - filter by user, event class "RFC/CPIC Logon" and "Transaction Start"
# Then correlate with SUIM role analysis:
#   SUIM > User > By Complex Selection Criteria > filter by authorization object S_RFC