Critical SAP NetWeaver Flaw Allows Attackers to Execute Arbitrary Code

A critical security vulnerability has been identified in SAP NetWeaver AS Java Deploy Service, allowing authenticated attackers to execute arbitrary code and potentially take full control of affected systems, according to Divya's report published on 10 September 2025. The flaw, tracked as CVE-2025-42922, stems from insecure file upload mechanisms and insufficient RBAC enforcement within the Deploy Web Service, enabling low-privileged users to upload and trigger malicious files such as JSP, WAR, or EAR.

The attack sequence begins after authentication, with attackers crafting multipart requests that the Deploy Web Service accepts without proper validation, leading to remote code execution and possible network lateral movement. Organisations are urged to apply patches via SAP Security Note 3643865, and to perform dependency analysis per SAP Note 1974464; SAP also provides a temporary workaround in Knowledge Base Article 3646072 for environments unable to patch immediately.

In addition, administrators should restrict Deploy Web Service access to administrative users and enable comprehensive audit logging to monitor suspicious POST requests, with IOCs including multipart/form-data submissions and HTTP POSTs to DeployWS endpoints from non-admin users. According to Redrays, monitoring for these indicators and reviewing access logs can help detect exploitation attempts and mitigate potential data exfiltration or system compromise.