SAP fixed a maximum severity flaw in SQL Anywhere Monitor

SAP has fixed 19 security issues, including a critical flaw in SQL Anywhere Monitor (Non-GUI) that involves hardcoded credentials and could allow arbitrary code execution. The vulnerability is tracked as CVE-2025-42890 and carries a CVSS score of 10/10, with the advisory noting that baked credentials expose resources or functionality to unintended users and could enable remote code execution, harming confidentiality, integrity and availability.

The release also covers a critical code injection flaw in SAP Solution Manager, tracked as CVE-2025-42887 (CVSS 9.9), caused by missing input sanitation and enabling an authenticated attacker to insert malicious code when calling a remote-enabled function module, potentially giving full control of the system. Additionally, SAP addressed CVE-2025-42944, a critical security hardening for insecure deserialization in SAP NetWeaver AS Java.

SAP suggests discontinuing the use of SQL Anywhere Monitor and deleting existing monitor database instances as a temporary workaround, and it remains unclear whether any flaws have been actively exploited in the wild.