CVE-2025-42968: SAP NetWeaver Information Disclosure Flaw

CVE-2025-42968 Overview

CVE-2025-42968 is a missing authorization vulnerability [CWE-862] affecting SAP NetWeaver. An authenticated non-administrative user can call a remote-enabled function module (RFM) that returns non-sensitive information about the SAP system and the underlying operating system. Exploitation does not require specialized knowledge or specific runtime conditions.

The vulnerability affects a broad range of SAP NetWeaver releases, from legacy 7.00 platforms through modern 9.16 builds. SAP addressed the flaw as part of the SAP Security Patch Day cycle via SAP Note #3621037.

Critical Impact
An authenticated attacker with low privileges can enumerate SAP system and OS metadata over the network, aiding reconnaissance for follow-on attacks against enterprise SAP landscapes.

Affected Products

SAP NetWeaver 7.00, 7.01, 7.02, 7.10, 7.31, 7.40, 7.50–7.58
SAP NetWeaver 8.16
SAP NetWeaver 9.14, 9.16

Discovery Timeline

2025-07-08 - CVE-2025-42968 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42968

Vulnerability Analysis

The flaw resides in a remote-enabled function module (RFM) exposed by SAP NetWeaver. RFMs are ABAP function modules callable over the Remote Function Call (RFC) protocol from external systems and users. This particular RFM does not enforce an authorization check appropriate to the data it returns.

An attacker holding a valid low-privileged SAP user account can invoke the function module over the network and receive information describing the SAP application server and the host operating system. The disclosed data is classified as non-sensitive, but it accelerates reconnaissance for lateral movement, version-targeted exploitation, and privilege escalation attempts.

The scope is unchanged, and integrity and availability are not affected. The impact is limited to confidentiality of environmental metadata.

Root Cause

The root cause is a missing authorization check [CWE-862]. The RFM permits execution by any authenticated principal instead of validating that the caller holds the specific authorization object required to view system metadata. SAP Note #3621037 introduces the missing authority-check logic.

Attack Vector

Exploitation occurs over the network using standard SAP RFC clients or ABAP callers. The attacker authenticates with any valid non-administrative SAP account, targets the vulnerable RFM, and receives system and OS descriptors in the response. No user interaction is required, and attack complexity is low.

The vulnerability is disclosure-only. It does not allow modification, code execution, or denial of service against the SAP application server. Consult the vendor advisory and SAP Note #3621037 for the RFM identifier and technical remediation details.

Detection Methods for CVE-2025-42968

Indicators of Compromise

Unusual RFC calls from non-administrative accounts targeting system information function modules.
Repeated invocations of the vulnerable RFM from a single user or workstation, indicating enumeration.
Authentication events from service or dialog users that historically do not perform RFC operations.

Detection Strategies

Enable SAP Security Audit Log (SM19/RSAU_CONFIG) and monitor RFC function calls executed by low-privileged users.
Correlate Gateway Server logs (gw/logging) with user authorization profiles to spot mismatched RFC activity.
Baseline normal RFC callers per function module, then alert on new principals invoking system-information RFMs.

Monitoring Recommendations

Forward SAP audit log, gateway log, and RFC trace data to a centralized SIEM for correlation with identity telemetry.
Alert on RFC calls originating from external network segments or non-SAP hosts.
Review authorization role assignments periodically to reduce the pool of accounts capable of RFC access.

How to Mitigate CVE-2025-42968

Immediate Actions Required

Apply the patch referenced in SAP Note #3621037 on all affected NetWeaver systems.
Inventory SAP NetWeaver kernels and ABAP stacks against the affected release list and prioritize internet-adjacent systems.
Restrict RFC access for non-administrative users to only the function modules required for their business role.

Patch Information

SAP released the fix during SAP Security Patch Day. Administrators should review the SAP Security Patch Day Announcement and implement the corrections delivered in SAP Note #3621037. The note contains the specific support package levels and manual pre-implementation steps.

Workarounds

Use SAP Unified Connectivity (UCON) to block or explicitly allow-list remote-enabled function modules exposed via RFC.
Tighten authorization objects S_RFC and S_RFCACL so that non-administrative users cannot invoke system-information RFMs.
Segment SAP application servers behind SAProuter or network ACLs to limit RFC exposure to trusted subnets.

bash

# Configuration example: restrict RFC function group access via S_RFC
# Assign in PFCG for the relevant role
Authorization object: S_RFC
  ACTVT      = 16          # Execute
  RFC_TYPE   = FUGR        # Function group
  RFC_NAME   = <approved function groups only>

# Enable UCON RFC runtime check (transaction UCONCOCKPIT)
# Move the vulnerable RFM out of the UCON allow-list until patched