CVE-2025-42960: SAP BW/4HANA Privilege Escalation Flaw

CVE-2025-42960 Overview

CVE-2025-42960 is a missing authorization vulnerability [CWE-862] affecting SAP Business Warehouse (BW) and SAP BW/4HANA Business Explorer (BEx) Tools. Authenticated attackers can exploit improper authorization checks to gain access levels beyond their assigned privileges. The flaw allows deletion of user table entries, impacting data integrity. Confidentiality and availability of the application are not affected. SAP addressed the issue as part of its coordinated Security Patch Day process.

Critical Impact
An authenticated low-privileged attacker can delete user table entries by bypassing authorization checks in BEx Tools, compromising data integrity in SAP BW and BW/4HANA environments.

Affected Products

SAP Business Warehouse (BEx Tools component)
SAP BW/4HANA (BEx Tools component)
SAP systems relying on BEx Tools for business intelligence reporting

Discovery Timeline

2025-07-08 - CVE-2025-42960 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42960

Vulnerability Analysis

The vulnerability resides in the BEx Tools component shared by SAP Business Warehouse and SAP BW/4HANA. BEx Tools fail to enforce authorization checks on operations that modify user table entries. An authenticated user with low privileges can invoke functions that should require elevated authorization. The attacker can then delete user table entries the account is not entitled to modify. The impact is scoped to integrity, and there is no direct disclosure of data or disruption of service. The EPSS probability is 0.204%, reflecting low observed exploitation likelihood at time of assessment.

Root Cause

The root cause is a missing authorization check [CWE-862] within the BEx Tools code paths that operate on user tables. The application authenticates the user but does not verify that the caller holds the authorization object required for the requested action. As a result, business-logic level access controls are bypassed while system-level authentication succeeds.

Attack Vector

The attack vector is network-based and requires valid SAP credentials. An attacker with a low-privileged SAP account issues requests to affected BEx Tools functions. Because the authorization check is absent, the request executes with the effective rights of a higher-privileged role. No user interaction is required. Exploitation typically occurs through standard SAP GUI or web interfaces exposed by BW and BW/4HANA. Refer to SAP Note #3608991 for vendor technical details.

Detection Methods for CVE-2025-42960

Indicators of Compromise

Unexpected deletion of entries in SAP user tables managed by BEx Tools
BEx Tools transactions executed by user accounts that lack the corresponding administrative role
Anomalous RFC or dialog calls to BEx Tools functions from non-administrative sessions

Detection Strategies

Enable SAP Security Audit Log (SM19/SM20) to capture authorization failures and successful sensitive transactions in BW and BW/4HANA
Correlate BEx Tools transaction execution with the executing user's role assignments to flag privilege mismatches
Review change documents and table logging for user tables to detect unauthorized deletions

Monitoring Recommendations

Forward SAP audit logs, change documents, and RFC gateway logs to a centralized SIEM for correlation across BW and BW/4HANA systems
Alert on delete operations against user tables performed outside of approved administrator accounts
Baseline typical BEx Tools usage per role and alert on deviations

How to Mitigate CVE-2025-42960

Immediate Actions Required

Apply the SAP security note referenced in SAP Note #3608991 to affected BW and BW/4HANA systems
Review authorization assignments for BEx Tools users and enforce least privilege
Audit recent activity on user tables to identify unauthorized deletions prior to patching

Patch Information

SAP released a fix for CVE-2025-42960 as part of its SAP Security Patch Day process. Customers should consult SAP Note #3608991 and the SAP Security Patch Day portal for supported versions, prerequisites, and installation guidance. Apply the note in non-production environments first, then promote through change control to production BW and BW/4HANA landscapes.

Workarounds

Restrict access to BEx Tools functions to trusted administrator roles until the patch is applied
Remove or tightly scope authorizations that expose the vulnerable BEx Tools transactions to general business users
Enable table logging for user tables to increase forensic visibility if delayed patching is unavoidable

bash

# Configuration example
# Review SAP Note #3608991 for authoritative patch steps.
# See https://me.sap.com/notes/3608991