Critical SAP NetWeaver Vulnerability Let Attackers Bypass Authorization Checks

Vulnerability Number: CVE-2025-42989

Severity Level: 9.6 (Critical)

Executive Summary

Vulnerability CVE‑2025‑42989 with a CVSS score of 9.6 is a serious privilege escalation vulnerability in SAP NetWeaver Application Server for ABAP (versions 7.89, 7.93, 9.14, 9.15). It stems from inadequate authorization checks during RFC inbound processing. An authenticated attacker with minimal privileges can exploit this flaw to gain elevated rights, potentially compromising system integrity and availability.

Details

The vulnerability targets Remote Function Call (RFC) inbound processing, failing to verify S_RFC authorizations properly. As RFC is fundamental for inter-system communication in SAP landscapes, this flaw could disrupt a wide range of business-critical processes. SAP issued Security Note #3600840 with specific configuration guidance. FAQ Note #3601919 assists administrators in identifying impacted users and adjusting roles accordingly.

Impact

• Privilege Escalation for low-privileged users
• Execution of sensitive function modules without appropriate checks
• Potential compromise of system integrity, confidentiality, and availability
• Risk of supply chain disruption due to reliance on RFC in SAP integrations

Mitigation Strategies

• Apply SAP Security Note #3600840 immediately
• Follow guidance in SAP FAQ Note #3601919
• Review and assign S_RFC permissions to appropriate users
• Set rfc/authCheckInPlaybook to 1 post-patching
• Conduct regression testing to ensure no business process disruptions due to new auth behavior
• General Hardening:
  • Follow SAP’s Patch Day advisories and best practices.Monitor RFC usage logs.Restrict RFC endpoint access to trusted systems.

Sources

• Critical SAP NetWeaver Vulnerability Let Attackers Bypass Authorization Checks
• NVD – CVE-2025-42989
• SAP Security Patch Day – June 2025

Contributing Authors

• Nima Khamooshi – Vice President, Cybersecurity Services
• Craig Taylor – Director SOC
• Ismael Belem – Cybersecurity Analyst II