SAP Patches Critical 10.0 Flaw in NetWeaver: Unauthenticated RCE Risk

According to SAP, its October 2025 Security Patch Day shipped fixes for 13 new security notes and three updates, including a critical vulnerability in SAP NetWeaver AS Java (CVE-2025-42944) that received a CVSS score of 10.0 and allows unauthenticated remote code execution. The flaw stems from insecure deserialization in the RMI-P4 module, which accepts serialized Java objects from network clients, and a successful exploit could lead to arbitrary OS command execution.

SAP notes that the most severe issue this month affects SAP NetWeaver AS Java SERVERCORE 7.50 and is wormable, requiring urgent action by organisations using NetWeaver AS Java to apply patches or temporarily mitigate by restricting access to RMI-P4 ports. In addition, the patch day addressed a directory traversal vulnerability in SAP Print Service (SAPSprint) and other high-severity flaws, but SAP emphasises immediate patching for the 10.0 NetWeaver RCE risk.