CVE-2025-42926: SAP NetWeaver Java Auth Bypass Flaw

CVE-2025-42926 Overview

CVE-2025-42926 is a missing authentication vulnerability in SAP NetWeaver Application Server Java. The application does not enforce authentication when a request targets internal files within the web application. An unauthenticated remote attacker can retrieve these files over the network and use their contents to profile the system. SAP tracks the fix under SAP Note #3619465, released on SAP Security Patch Day. The weakness is classified as [CWE-306] Missing Authentication for Critical Function. The vulnerability has a limited impact on confidentiality and does not affect integrity or availability of the server.

Critical Impact
Unauthenticated network attackers can read internal web application files on SAP NetWeaver AS Java, disclosing configuration and system details that support follow-on attacks.

Affected Products

SAP NetWeaver Application Server Java 7.50
Deployments exposed to untrusted networks without compensating access controls
Systems that have not applied SAP Note #3619465

Discovery Timeline

2025-09-09 - CVE-2025-42926 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42926

Vulnerability Analysis

SAP NetWeaver Application Server Java exposes internal web application resources through HTTP endpoints. The server processes requests for these resources without validating that the caller has authenticated. An attacker can send crafted HTTP requests to retrieve internal files that would normally be restricted to server-side use. Recovered content may include configuration data, deployment descriptors, or references that reveal software versions and internal paths. This information supports reconnaissance and helps chain further attacks against SAP business services. The Exploit Prediction Scoring System places CVE-2025-42926 in the lower range of predicted exploitation likelihood, and no public proof-of-concept or CISA KEV entry exists at time of writing.

Root Cause

The root cause is missing enforcement of authentication on request handlers that serve internal web application content. The server treats these paths as reachable without a valid session, violating the access model expected for internal resources. This maps to [CWE-306] Missing Authentication for Critical Function.

Attack Vector

Exploitation requires only network reachability to the SAP NetWeaver AS Java HTTP interface. The attacker sends direct requests for internal file paths within the web application context. No credentials, prior privileges, or user interaction are needed. Successful requests return internal file contents in the HTTP response body.

No verified public exploit code is available. Refer to the SAP Note #3619465 advisory for authoritative technical guidance.

Detection Methods for CVE-2025-42926

Indicators of Compromise

Unauthenticated HTTP requests to SAP NetWeaver AS Java that return non-empty responses for internal application paths
Access log entries showing requests without a valid session cookie or authentication header succeeding against protected components
Repeated enumeration patterns targeting internal file names or directories within the web application root

Detection Strategies

Baseline authenticated versus unauthenticated request rates on the AS Java HTTP listener and alert on deviations
Inspect web dispatcher and ICM logs for 2xx responses to internal paths where the caller presented no credentials
Correlate reconnaissance requests to SAP endpoints with subsequent authentication attempts from the same source

Monitoring Recommendations

Forward SAP NetWeaver AS Java HTTP access logs to a centralized log platform for retention and search
Track requests targeting configuration or deployment descriptor paths and alert on external source IPs
Review egress traffic from SAP hosts to detect follow-on exfiltration after reconnaissance

How to Mitigate CVE-2025-42926

Immediate Actions Required

Apply the SAP-provided fix referenced in SAP Note #3619465 to all affected AS Java instances
Restrict network exposure of SAP NetWeaver AS Java HTTP endpoints to trusted management networks
Review web dispatcher access control lists to block direct requests to internal application paths

Patch Information

SAP released the fix through SAP Security Patch Day. Administrators must apply the correction described in SAP Note #3619465 on the affected SAP NetWeaver Application Server Java 7.50 systems. Consult the SAP Security Patch Day portal for the current patch bundle and prerequisites.

Workarounds

Deploy web dispatcher or reverse proxy rules that reject unauthenticated requests to internal file paths until the patch is applied
Limit inbound access to the AS Java HTTP port using network segmentation and firewall policies
Increase log retention and monitoring on the affected AS Java instances during the remediation window

bash

# Example web dispatcher rule to block unauthenticated access to internal paths
# Place in the icm/HTTP/mod_<n> handler chain and reload the dispatcher
if %{HEADER:AUTHORIZATION} !stricmp ""
  RegIRedirectUrl ^/internal/.* /error/403.html [break]
end