CVE-2025-42986: SAP BASIS Authorization Bypass Vulnerability

CVE-2025-42986 Overview

CVE-2025-42986 is a missing authorization check vulnerability in an obsolete Remote Function Call (RFC) enabled function module within SAP BASIS. An authenticated low-privileged attacker can invoke the exposed RFC to access restricted system information. The flaw maps to [CWE-862: Missing Authorization]. The issue affects a broad range of SAP BASIS releases from 700 through 754. SAP addressed the vulnerability in its Security Patch Day release, tracked as SAP Note #3626440.

Critical Impact
An authenticated user with low privileges can invoke a legacy RFC module to disclose restricted SAP system information, undermining confidentiality of the affected ABAP application server.

Affected Products

SAP BASIS versions 700, 701, 702, 731
SAP BASIS versions 740, 750, 751
SAP BASIS versions 752, 753, 754

Discovery Timeline

2025-07-08 - CVE-2025-42986 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42986

Vulnerability Analysis

SAP BASIS provides the runtime and infrastructure services for ABAP-based SAP systems, including the RFC interface used for inter-system communication. The affected function module is described by SAP as obsolete but remains RFC-enabled and callable across the network on unpatched systems. The module does not perform an authorization check before returning system information to the caller. As a result, any authenticated user with an RFC-capable account can query the module and retrieve data that should be restricted to privileged administrators. The vulnerability is limited to confidentiality; integrity and availability of the application are not affected.

Root Cause

The root cause is the absence of an AUTHORITY-CHECK statement within an RFC-enabled ABAP function module retained for backward compatibility. Without the check, the module trusts any caller that has established an authenticated RFC session, regardless of role assignments or S_RFC authorizations restricting the specific function group.

Attack Vector

Exploitation requires network access to the SAP application server's RFC gateway and valid credentials for any low-privileged SAP user permitted to open RFC connections. An attacker uses a standard RFC client, such as the SAP GUI, an sapnwrfc-based script, or pyrfc, to call the vulnerable module by name. The server executes the function and returns restricted system metadata to the caller without evaluating whether the account holds the required authorization object.

No verified proof-of-concept code is available. Refer to SAP Note #3626440 for the authoritative technical description and remediation guidance.

Detection Methods for CVE-2025-42986

Indicators of Compromise

Successful RFC calls from low-privileged accounts to obsolete function modules identified in SAP Note #3626440.
Unusual RFC traffic patterns targeting SAP BASIS function groups from workstations or service accounts that historically do not perform administrative queries.
Security Audit Log (SM19/SM20) entries showing repeated RFC executions by the same non-administrative user against system-information function modules.

Detection Strategies

Enable and review the SAP Security Audit Log for RFC function calls, filtering on the affected module names listed in the SAP Note.
Correlate RFC gateway logs (gw/logging) with user role assignments to surface calls that bypass expected authorization boundaries.
Use SAP UCON (Unified Connectivity) in logging mode to inventory which RFC modules are being invoked and by which users, then flag calls to obsolete modules.

Monitoring Recommendations

Forward SAP Security Audit Log and gateway trace data into a centralized SIEM for continuous analysis and alerting on anomalous RFC activity.
Baseline normal RFC usage per user and alert on deviations, particularly low-privileged accounts calling BASIS system modules.
Track authentication events for RFC-capable service accounts and alert on new source hosts or off-hours activity.

How to Mitigate CVE-2025-42986

Immediate Actions Required

Apply the patch referenced in SAP Note #3626440 across all SAP BASIS instances in scope.
Review the SAP Security Patch Day Update for related notes and prerequisites.
Audit S_RFC authorizations and remove blanket access to sensitive function groups from non-administrative roles.

Patch Information

SAP released the fix through its Security Patch Day process. Administrators should implement the corrections delivered in SAP Note #3626440 on all affected SAP BASIS releases from 700 through 754. Validate the note's prerequisites and support package levels before deployment in production.

Workarounds

Restrict RFC access at the SAP gateway using reginfo and secinfo access control lists to permit only authorized program registrations and callers.
Deploy SAP UCON in active mode to block RFC calls to function modules not required by legitimate business processes, including the obsolete module in question.
Tighten S_RFC authorization objects so low-privileged users cannot invoke SAP BASIS function groups that expose system information.

bash

# Example gateway ACL entry restricting RFC callers (reginfo)
# Only permit registered programs from trusted hosts
P TP=* HOST=<trusted-app-host> ACCESS=<trusted-app-host> CANCEL=<trusted-app-host>
D TP=* HOST=* ACCESS=* CANCEL=*