CVE-2025-42916 Overview
CVE-2025-42916 is a missing input validation vulnerability in SAP ABAP reports. An attacker with high-privilege access can delete the contents of arbitrary database tables when those tables lack an authorization group. The flaw is classified under [CWE-1287: Improper Validation of Specified Type of Input]. Exploitation requires adjacent network access and high privileges, but no user interaction. Successful exploitation produces high impact on integrity and availability while confidentiality remains unaffected. SAP addressed the issue as part of the September 2025 Security Patch Day cycle.
Critical Impact
An authenticated adversary can wipe the contents of any database table that is not shielded by an SAP authorization group, causing data loss and service disruption across dependent SAP modules.
Affected Products
- SAP NetWeaver Application Server ABAP
- SAP ABAP report execution components
- SAP systems with database tables lacking authorization group protection
Discovery Timeline
- 2025-09-09 - CVE-2025-42916 published to NVD alongside SAP Security Patch Day
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-42916
Vulnerability Analysis
The vulnerability resides in ABAP reports that accept table names or related identifiers as input parameters without validating them against an allowlist or authorization boundary. When an ABAP report executes a delete operation on a caller-supplied table name, the runtime performs the operation without confirming that the target table is legitimate or authorized for modification.
SAP mitigates this class of risk through authorization groups assigned to tables. Tables without an assigned authorization group are effectively unprotected against generic table operations. An attacker with the required privileges can name any unprotected table, and the ABAP runtime deletes its contents.
The consequences extend beyond simple data loss. Deleting configuration, customizing, or transactional tables can render dependent SAP modules non-functional and cascade into business process outages [CWE-1287].
Root Cause
The root cause is missing input validation on table identifiers passed to ABAP reports that perform table deletion. The reports rely on ambient authorization checks that assume all sensitive tables carry an authorization group. Tables without such grouping fall outside the security perimeter and become reachable through the vulnerable code path.
Attack Vector
An attacker must hold high-privilege ABAP credentials and reach the SAP application server over an adjacent network. The attacker invokes the vulnerable ABAP report and supplies the name of a target table lacking an authorization group. The report executes the deletion without further validation. No user interaction is required, and the scope changes because the affected component acts on database resources managed by a separate security authority.
Refer to SAP Note #3635475 and the SAP Security Patch Day Update for the authoritative technical description.
Detection Methods for CVE-2025-42916
Indicators of Compromise
- Unexpected DELETE or table truncation events in SAP database audit logs targeting tables without an assigned authorization group.
- ABAP report executions by high-privilege users referencing arbitrary or unusual table names as input parameters.
- Sudden loss of records in configuration or customizing tables followed by application errors in dependent SAP modules.
Detection Strategies
- Enable and review the SAP Security Audit Log (SM19/SM20) for report starts by users with SAP_ALL or equivalent privileges.
- Correlate database change logs with ABAP report execution timestamps to identify report-initiated bulk deletions.
- Baseline normal ABAP report parameter values and alert on deviations that supply table names as arguments.
Monitoring Recommendations
- Forward SAP audit logs and database change records into a centralized analytics platform for cross-source correlation.
- Monitor privileged ABAP accounts for anomalous session activity originating from adjacent network segments.
- Track table row-count deltas on business-critical tables and alert on sudden decreases outside maintenance windows.
How to Mitigate CVE-2025-42916
Immediate Actions Required
- Apply SAP Note #3635475 to all affected SAP ABAP systems following the vendor's implementation guidance.
- Inventory database tables that lack an assigned authorization group and assign appropriate groups to sensitive tables.
- Review and reduce membership in high-privilege ABAP roles that grant access to the vulnerable reports.
Patch Information
SAP released the fix as part of the September 2025 Security Patch Day. Administrators should implement SAP Note #3635475 and follow the guidance in the SAP Security Patch Day Update. Verify that the corresponding kernel or support package updates are applied across development, quality assurance, and production landscapes.
Workarounds
- Assign authorization groups to unprotected tables using transaction SE54 to bring them under standard S_TABU_DIS access checks.
- Restrict execution of the vulnerable ABAP reports to a minimal set of accountable administrators.
- Segment the SAP application server network to reduce adjacent-network exposure from untrusted zones.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
