CVE-2025-42949: ABAP Platform Auth Bypass Vulnerability

CVE-2025-42949 Overview

CVE-2025-42949 is a missing authorization check [CWE-862] in the SAP ABAP Platform. An authenticated user with elevated privileges can bypass authorization restrictions on common transactions by leveraging the SQL Console. The flaw allows unauthorized reading of database table contents, compromising data confidentiality. Integrity and availability remain unaffected. SAP addressed the issue in SAP Note #3626722 released during SAP Security Patch Day.

Critical Impact
An authenticated attacker with elevated privileges can read arbitrary database table contents through the SQL Console, bypassing standard transaction-level authorization controls.

Affected Products

SAP ABAP Platform (see SAP Note #3626722 for exact SP and kernel levels)
SAP NetWeaver ABAP-based systems exposing the SQL Console
SAP S/4HANA installations running affected ABAP Platform releases

Discovery Timeline

2025-08-12 - CVE-2025-42949 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42949

Vulnerability Analysis

The SAP ABAP Platform provides an SQL Console used by administrators and developers to execute direct database queries. Standard SAP transactions enforce authorization objects that restrict which users can view or modify specific tables. The SQL Console path does not enforce those same authorization checks, creating an inconsistent authorization surface.

An authenticated user with elevated privileges can query database tables that would otherwise be blocked through the normal transaction interface. The vulnerability exposes only read access to stored data. It does not permit modifications or service disruption, so integrity and availability are not affected.

The weakness maps to [CWE-862]: Missing Authorization. The flaw stems from an omitted check in the code path that services SQL Console queries rather than from a flawed authorization design.

Root Cause

The ABAP Platform enforces authorization objects on transaction entry points but omits equivalent checks when queries are executed through the SQL Console interface. Attackers with legitimate console access exploit this gap to read tables protected at the transaction layer.

Attack Vector

Exploitation requires network access to the SAP application server and authenticated credentials with elevated privileges sufficient to reach the SQL Console. No user interaction is required. The attacker issues SELECT queries against sensitive tables containing business, HR, financial, or authentication data. Refer to SAP Note #3626722 for the authoritative technical description.

Detection Methods for CVE-2025-42949

Indicators of Compromise

SQL Console activity from user accounts that do not routinely perform database queries.
SELECT statements targeting sensitive tables such as USR02, PA0008, or client configuration tables outside normal administrative workflows.
Unusual volumes of read operations logged by the SAP kernel for a single administrative session.

Detection Strategies

Enable and review the SAP Security Audit Log (SM19/RSAU_CONFIG) for SQL Console usage events.
Correlate SQL Console query events with the executing user, source terminal, and time window.
Baseline normal administrative query patterns and alert on deviations, particularly access to HR, payroll, and credential tables.

Monitoring Recommendations

Forward SAP audit and application logs to a centralized SIEM for retention and correlation with identity events.
Alert on elevated-privilege accounts executing SQL Console queries outside change windows.
Review authorization assignments for objects that grant SQL Console access and reduce membership to the minimum required.

How to Mitigate CVE-2025-42949

Immediate Actions Required

Apply the patch described in SAP Note #3626722 to all affected ABAP Platform instances.
Inventory accounts that hold authorizations enabling SQL Console access and remove entitlements that are not operationally required.
Review recent SQL Console activity for signs of unauthorized table access prior to patch deployment.

Patch Information

SAP released the fix through the SAP Security Patch Day process. Administrators must download and apply SAP Note #3626722 and follow the release schedule published on the SAP Security Patch Day portal. Patch levels vary by ABAP Platform release; consult the note for exact support package and kernel versions.

Workarounds

Restrict SQL Console access to a small, audited group of database administrators pending patch deployment.
Enforce segregation of duties so that transaction-level administrators do not also hold SQL Console authorizations.
Enable full Security Audit Log coverage for SQL Console events and route logs to a monitored SIEM.

bash

# Configuration example
# Review users with SQL Console-related authorizations using SUIM
# Transaction: SUIM -> Users by Complex Selection Criteria -> Authorization Values
# Filter authorization object: S_DEVELOP with ACTVT 03/16 and OBJTYPE relevant to DB tooling
# Enable Security Audit Log for elevated users
# Transaction: RSAU_CONFIG
#   - Activate audit for classes: RFC, Transaction Start, Report Start, Generic Table Access
#   - Filter on user group SUPER / BASIS_ADMIN