CVE-2025-42982: SAP GRC Auth Bypass Vulnerability

CVE-2025-42982 Overview

CVE-2025-42982 is a missing authorization vulnerability [CWE-862] in SAP Governance, Risk, and Compliance (GRC). The flaw allows a non-administrative authenticated user to access and initiate a transaction that controls transmitted system credentials. An attacker with low-privileged access can modify or intercept credentials sent between systems. The vulnerability impacts the confidentiality, integrity, and availability of the affected SAP GRC application. SAP addressed the issue in Security Note 3609271, released on the June 2025 SAP Security Patch Day.

Critical Impact
Authenticated low-privileged users can manipulate transmitted system credentials in SAP GRC, enabling lateral movement and compromise of connected SAP systems.

Affected Products

SAP Governance, Risk, and Compliance (GRC)
SAP GRC modules relying on the affected transaction for system credential transmission
Connected SAP systems whose credentials are managed through SAP GRC

Discovery Timeline

2025-06-10 - CVE-2025-42982 published to NVD and disclosed via SAP Security Patch Day
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-42982

Vulnerability Analysis

The vulnerability resides in an SAP GRC transaction that handles the transmission of system credentials between SAP components. The transaction lacks proper authorization checks, allowing users without administrative privileges to invoke it. Once invoked, the attacker can modify or control the credentials being transmitted to connected systems.

SAP GRC commonly manages privileged access, emergency access (Firefighter), and cross-system risk controls. Compromise of credential transmission within this product creates a direct path to systems GRC is intended to govern. The Common Weakness Enumeration classification [CWE-862] indicates a missing authorization check rather than a flawed one.

Exploitation requires only network access to the SAP GRC application and a valid low-privileged account. No user interaction is required, and attack complexity is low.

Root Cause

The root cause is the absence of an authorization check on a sensitive transaction. SAP transactions typically rely on authorization objects such as S_TCODE and module-specific objects to gate execution. The affected transaction either omits these checks or evaluates them incorrectly, permitting any authenticated user to reach credential-handling logic intended for administrators.

Attack Vector

An authenticated attacker authenticates to SAP GRC with any valid user account. The attacker then navigates to or invokes the vulnerable transaction over the network. Because the transaction lacks authorization enforcement, execution proceeds despite the missing administrative role. The attacker manipulates the transaction inputs to alter, redirect, or capture credentials transmitted to remote SAP systems. Captured credentials can then be replayed against connected backends, expanding the breach beyond GRC.

No verified public exploit is available at this time. Technical details are restricted to SAP Security Note 3609271, which is accessible to SAP customers.

Detection Methods for CVE-2025-42982

Indicators of Compromise

Execution of GRC credential-related transactions by user accounts that lack administrative roles.
Unexpected changes to RFC destinations, system connectors, or stored credentials within SAP GRC.
Authentication events on connected SAP systems originating from GRC service accounts at unusual times or from unusual sources.
Audit log entries showing transaction invocation followed by credential field modifications from a single low-privileged session.

Detection Strategies

Enable and review the SAP Security Audit Log (SM19/RSAU_CONFIG) for transaction starts by non-administrative users on GRC credential transactions.
Correlate SAP GRC change documents with the user role assignments active at the time of the change.
Monitor RFC and Web Service call patterns for anomalous credential usage from GRC-managed accounts.

Monitoring Recommendations

Forward SAP Security Audit Log and GRC change logs to a centralized SIEM for correlation against identity and network telemetry.
Baseline normal administrative activity within SAP GRC and alert on deviations such as transaction execution by users outside the GRC administrator group.
Track authentication failures and successes on systems whose credentials are stored in GRC to identify replay activity.

How to Mitigate CVE-2025-42982

Immediate Actions Required

Apply SAP Security Note 3609271 to all affected SAP GRC systems without delay.
Audit and reduce the population of users with access to SAP GRC, particularly those holding S_TCODE authorizations broader than required.
Rotate any system credentials stored or transmitted by SAP GRC, assuming potential prior exposure.
Review GRC audit logs for retroactive evidence of unauthorized transaction execution.

Patch Information

SAP released the fix on the June 2025 Security Patch Day. Customers must download and apply SAP Security Note 3609271. Additional context is published on the SAP Security Patch Day Update page. The patch introduces the missing authorization check on the affected transaction.

Workarounds

Restrict access to the affected GRC transaction through custom authorization role adjustments until the patch is applied.
Limit network reachability of the SAP GRC application to administrative workstations using firewall or SAProuter rules.
Disable or quarantine inactive low-privileged accounts that could be used by an internal attacker to reach the vulnerable transaction.

bash

# Example: restrict transaction access via PFCG role adjustment (illustrative)
# 1. Identify roles granting S_TCODE for the affected transaction
# 2. Remove the transaction from non-administrative roles
# 3. Activate the role and propagate to production
SU24  # maintain authorization defaults
PFCG  # adjust role authorizations
SU25  # post-upgrade authorization sync after patch