New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login

SAP has released security fixes for 13 new issues, including a maximum-severity vulnerability in SAP NetWeaver AS Java that could lead to arbitrary command execution via insecure deserialization. The flaw, tracked as CVE-2025-42944, carries a CVSS score of 10.0 and is described as insecure deserialization; an unauthenticated attacker could exploit the RMI-P4 module by sending a malicious payload to an open port.

According to a description of the flag in CVE[.]org, the deserialization of untrusted Java objects could result in arbitrary OS command execution, posing a high impact on the application's confidentiality, integrity and availability. Although SAP addressed this vulnerability last month, security company Onapsis said the latest fix adds extra safeguards, including a JVM-wide filter (jdk[.]serialFilter) to block certain classes, with guidance developed in collaboration with ORL.

Deserialization remains the major risk, Pathlock's Jonathan Stross said, as the P4/RMI chain continues to drive critical exposure in AS Java. There are also other critical flaws patched, including CVE-2025-42937, CVE-2025-42910 and a directory traversal vulnerability in SAP Print Service.