SAP fixed maximum-severity bug in NetWeaver

According to SAP, the vendor fixed 13 new vulnerabilities, including a maximum-severity issue tracked as CVE-2025-42944 (CVSS 10.0) in SAP NetWeaver. The flaw stems from insecure deserialization that could allow an unauthenticated attacker to achieve arbitrary command execution via the RMI-P4 module by sending a crafted payload to an open port.

In addition, SAP addressed a Directory Traversal vulnerability in SAP Print Service, CVE-2025-42937 (CVSS 9.8), which could let unauthenticated attackers overwrite system files and compromise confidentiality, integrity and availability. A third critical issue is an Unrestricted File Upload in SAP Supplier Relationship Management, CVE-2025-42910 (CVSS 9.0), where missing verification of file type or content could enable an attacker to upload arbitrary files that might be executed by users.

The company notes there are no reports of attacks in the wild exploiting these vulnerabilities. The article is by Pierluigi Paganini and dated 15 October 2025.