CVE-2025-42918 Overview
CVE-2025-42918 is a missing authorization check [CWE-862] in SAP NetWeaver Application Server for ABAP. Authenticated users with access to background processing can read profile parameters without proper authorization. The vulnerability exposes configuration data that should be restricted to administrative roles.
The flaw affects a broad range of SAP Basis releases from 700 through 816. Exploitation requires an authenticated account with background processing privileges, and impact is limited to confidentiality of profile parameter values.
Critical Impact
Authenticated attackers with background processing access can enumerate SAP profile parameters, exposing configuration details that may aid further attacks against the SAP landscape.
Affected Products
- SAP NetWeaver Application Server for ABAP (SAP Basis 700, 701, 702, 731, 740)
- SAP Basis releases 750 through 758
- SAP Basis release 816
Discovery Timeline
- 2025-09-09 - CVE-2025-42918 published to NVD alongside SAP Security Patch Day
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-42918
Vulnerability Analysis
The vulnerability resides in SAP NetWeaver Application Server for ABAP background processing functionality. The affected code path retrieves SAP profile parameter values but fails to verify that the calling user holds the authorization required to view them. Profile parameters govern instance behavior, including memory allocation, security settings, logon parameters, and connectivity endpoints.
An authenticated user who has been granted access to background processing services can invoke the impacted function and receive parameter values that are normally restricted. The exposed data does not include stored secrets, but it reveals system configuration that supports reconnaissance for subsequent attacks. The vulnerability does not permit modification of parameter values, and it does not degrade system availability.
Root Cause
The root cause is a missing authorization check [CWE-862]. The background processing code path invokes profile parameter retrieval logic without first calling the SAP authority-check that gates access to system configuration objects. As a result, any authenticated principal with the background processing authorization inherits read access to profile parameters that should require a separate administrative role.
Attack Vector
Exploitation requires network access to the SAP application server and valid credentials for an account with background processing privileges. No user interaction is required and attack complexity is low. Once authenticated, the attacker triggers the vulnerable background processing function to enumerate profile parameters and harvest configuration details for lateral movement or targeted follow-on attacks.
No public proof-of-concept exploit is available, and CISA has not added this issue to the Known Exploited Vulnerabilities catalog. See SAP Note #3623504 for vendor-specific technical details.
Detection Methods for CVE-2025-42918
Indicators of Compromise
- Unexpected background job submissions from non-administrative users targeting system configuration functions.
- Anomalous read access to profile parameter tables or RFC-enabled function modules that return instance configuration.
- Accounts granted background processing authorizations performing reconnaissance-style activity outside of scheduled job windows.
Detection Strategies
- Review SAP Security Audit Log (SM19/SM20) entries for background job activity by users who do not typically operate batch workloads.
- Correlate SU01 role assignments with runtime authority-check failures logged in transaction SU53 to identify users probing restricted objects.
- Baseline expected callers of background processing functions and alert on new principals invoking profile parameter retrieval.
Monitoring Recommendations
- Forward SAP Security Audit Log, gateway log, and RFC log data to a centralized SIEM for correlation across the SAP landscape.
- Enable table-level logging for tables that expose profile parameter data and review changes to authorization role definitions.
- Track privileged authorization objects related to background processing and generate alerts when they are assigned to new users.
How to Mitigate CVE-2025-42918
Immediate Actions Required
- Apply the patch referenced in SAP Note #3623504 to all affected SAP Basis releases.
- Audit users assigned background processing authorizations and remove entitlements that are no longer required.
- Rotate credentials for service and technical accounts that hold background processing privileges if abuse is suspected.
Patch Information
SAP addressed CVE-2025-42918 as part of SAP Security Patch Day. Administrators should download and apply the corrections described in SAP Note #3623504 across all affected SAP Basis releases from 700 through 816. Consult the SAP Security Patch Day portal for the current corrections list and prerequisite notes.
Workarounds
- Restrict assignment of background processing authorization objects (for example, S_BTCH_JOB and S_BTCH_ADM) to a minimal set of operational accounts.
- Enforce segregation of duties so that background processing roles are separate from roles that legitimately require access to profile parameters.
- Enable SAP Security Audit Log coverage for the impacted function group and monitor for unexpected access pending patch deployment.
# Configuration example: enable SAP Security Audit Log via profile parameters
rsau/enable = 1
rsau/selection_slots = 10
rsau/user_selection = 1
# Apply via RZ10, restart the instance, then configure filters in SM19
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
