SAP Patches Critical NetWeaver Vulnerabilities

SAP has released 21 new and four updated security notes, addressing several critical-severity NetWeaver vulnerabilities that could enable remote code execution and privilege escalation. The most severe flaw, CVE-2025-42944 (CVSS 10/10), is an insecure deserialization issue in the RMI-P4 module of AS Java that allows unauthenticated attackers to execute arbitrary OS commands via an open port.

Following closely is CVE-2025-42922 (CVSS 9.9), an insecure file operation flaw in NetWeaver AS Java’s Deploy Web Service that could let attackers upload arbitrary files and potentially trigger remote code execution; according to Onapsis, “On file execution, the system can be fully compromised.” The third critical note, CVE-2025-42958 (CVSS 9.1), is a missing authorization

check in NetWeaver running on IBM i-series, requiring high privileges to exploit and enabling reading, modification or deletion of sensitive information and access to privileged functions. SAP also updated a security note first released in March 2023, addressing a critical directory traversal defect in NetWeaver AS ABAP. Security teams are advised to apply the patches promptly, as SAP notes no active exploitation in the wild, though threat actors are known to have exploited SAP flaws for which patches exist. 9 September 2025.