Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2025-42961 Overview
CVE-2025-42961 is a missing authorization vulnerability in the SAP NetWeaver Application Server for ABAP. An authenticated user with high privileges can exploit insufficient validation of user permissions to read sensitive database tables. The flaw stems from overly permissive access configurations that allow unauthorized reads of critical business data.
The issue is classified under [CWE-862] (Missing Authorization). Exploitation impacts confidentiality only; integrity and availability of the underlying system remain unaffected.
Critical Impact
A high-privileged authenticated user can read sensitive database tables in SAP NetWeaver ABAP, exposing confidential business data stored in the SAP backend.
Affected Products
- SAP NetWeaver Application Server for ABAP
- Refer to SAP Note #3610322 for the definitive list of affected releases
- Additional details are published on SAP Security Patch Day
Discovery Timeline
- 2025-07-08 - CVE-2025-42961 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-42961
Vulnerability Analysis
The vulnerability originates in the SAP NetWeaver ABAP stack, where a code path performs data access without validating whether the caller holds the required authorization objects. ABAP applications typically enforce access using AUTHORITY-CHECK statements tied to authorization objects such as S_TABU_DIS or S_TABU_NAM. When these checks are missing or incomplete, callers can reach table read operations they should not be permitted to invoke.
Exploitation requires an authenticated account with elevated privileges within the SAP system. The attacker does not need local access or user interaction. Once inside, the attacker can query sensitive tables and exfiltrate data that would normally be restricted by role-based access.
Because the flaw only permits reads, no data modification or service disruption occurs. The impact is confined to disclosure of confidential business, financial, or personal information stored in ABAP-managed tables.
Root Cause
The root cause is an omitted authorization check in an ABAP-side function or report. The vulnerable path fails to invoke AUTHORITY-CHECK before returning table contents to the caller, so the runtime accepts requests from any privileged session regardless of role assignment.
Attack Vector
The attack vector is network-based against a NetWeaver ABAP application server. The attacker authenticates with high-privilege credentials, invokes the affected functionality through a supported client channel such as SAP GUI, RFC, or an exposed web endpoint, and receives the contents of restricted tables. No exploit code or public proof-of-concept has been published at the time of writing.
Detection Methods for CVE-2025-42961
Indicators of Compromise
- Unexpected reads against sensitive ABAP dictionary tables by accounts that do not normally access those tables
- RFC or SAP GUI activity from privileged accounts targeting the affected function module or report outside of change windows
- Security Audit Log (SM19/SM20) entries showing successful table access without corresponding authorization role assignments
Detection Strategies
- Enable the SAP Security Audit Log for all high-privilege users and forward events to a centralized SIEM
- Baseline normal table-access patterns for privileged accounts and alert on deviations targeting sensitive tables
- Review SUIM reports for users granted broad authorization objects such as S_TABU_DIS and S_TABU_NAM
Monitoring Recommendations
- Ingest SAP NetWeaver audit logs into a security data lake for correlation with identity and endpoint telemetry
- Alert on bulk read operations against payroll, finance, and HR tables initiated by administrative accounts
- Monitor RFC gateway logs for calls to function modules identified in SAP Note #3610322
How to Mitigate CVE-2025-42961
Immediate Actions Required
- Apply the SAP-provided correction referenced in SAP Note #3610322 to all affected NetWeaver ABAP systems
- Review and reduce membership in high-privilege roles that could exploit the missing authorization check
- Audit assignments of S_TABU_DIS, S_TABU_NAM, and S_TABU_CLI to enforce least privilege for table access
Patch Information
SAP released the fix as part of its monthly Security Patch Day. Administrators should download and apply the correction described in SAP Note #3610322. Consult the SAP Security Patch Day portal for the full patch set and applicable support package levels.
Workarounds
- Restrict network access to NetWeaver ABAP interfaces so only authorized administrative networks can reach RFC and SAP GUI endpoints
- Remove or tighten authorization profiles that grant unrestricted table access to non-administrative users
- Increase Security Audit Log verbosity for privileged users until the patch can be deployed
# Example: enable Security Audit Log filter for privileged users via SM19
# 1. Transaction: SM19
# 2. Create static profile: SEC_AUDIT_PRIV
# 3. Add filter: User = SAP*, DDIC, and named admin accounts
# 4. Events: enable all Critical (AU1-AU9) and RFC call events
# 5. Activate profile and verify with SM20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
