SAP addressed 13 new flaws, including a maximum severity vulnerability in SAP NetWeaver, which could lead to arbitrary command execution.
SAP addressed 13 new vulnerabilities, including a maximum severity issue, tracked as CVE-2025-42944 (CVSS score of 10.0) in SAP NetWeaver.
The vulnerability is an insecure deserialization that could lead to arbitrary command execution.
“Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port.” reads the advisory. “The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application’s confidentiality, integrity, and availability.”
The company also addressed a Directory Traversal vulnerability in SAP Print Service tracked as CVE-2025-42937 (CVSS score of 9.8). The flaw in SAP Print Service (SAPSprint) allows unauthenticated attackers to use path traversal to overwrite system files, threatening the application’s confidentiality, integrity, and availability.
The third critical vulnerability addressed by SAP is an Unrestricted File Upload Vulnerability, tracked as CVE-2025-42910 (CVSS score of 9.0), in SAP Supplier Relationship Management.
“Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware.” reads the advisory. “On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.”
The company is not aware of attacks in the wild exploiting any of these vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, NetWeaver)
