SAP NetWeaver Memory Corruption Flaw Lets Attackers Send Corrupted Logon Tickets

A newly disclosed vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (CVE-2025-42902) allows unauthenticated attackers to crash server processes by sending malformed SAP Logon or SAP Assertion Tickets. Rated Medium severity with a 5.3 CVSS 3.1 score, the flaw stems from a NULL pointer dereference that triggers memory corruption and process termination. Affected versions include all supported releases from 7.22 through 9.16, and SAP released advisory notes and patches on 14 October 2025.

The issue arises from insufficient validation of incoming tickets, with a remote, unauthenticated exploitation possibility that can lead to denial-of-service conditions through repeated ticket submissions. SAP has published security note 3627308 and issued patches on its October 2025 patch day; administrators should apply the provided kernel and platform updates immediately, according to SAP.

As a temporary workaround, organisations can block external logon ticket parsing on the SAP ICM component, though this may disrupt legitimate federated logins, and proactive patching remains the best defence given that no exploitation has been publicly observed.