CVE-2025-42961
Missing Authorization check in SAP NetWeaver Application Server for ABAP
Reported by sap · Published July 8, 2025
Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized reading of critical data is possible, resulting in a significant impact on the confidentiality of the information stored. However, the integrity and availability of the system remain unaffected.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP NetWeaver Application Server for ABAP | SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702 |
| SAP_SE | SAP NetWeaver Application Server for ABAP | * |
Timeline
- Jul 7, 2025 CVE Published
- Jul 8, 2025 EPSS Score (30 in total, the first dated here)
- Jul 8, 2025 Coalition ESS Score (12 in total, the first dated here)
- Dec 14, 2025 CVE Updated
- Mar 17, 2026 Security Advisory (4 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-42961
vulnetix vdb fixes CVE-2025-42961Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-42961/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart