SAP issues 21 new and 4 updated security notes, fixing critical NetWeaver flaws enabling RCE and privilege escalation.
SAP this week issued 21 new and four updated security notes as part of the company’s September Patch Day, including four notes that address critical vulnerabilities in NetWeaver.
Onapsis Research Labs supported SAP in patching two critical flaws in NetWeaver AS Java. Note #3634501 addresses an insecure deserialization issue, tracked as CVE-2025-42944 (CVSS score of 10.0), in the RMI-P4 module, enabling unauthenticated RCE via malicious payloads.
“The vulnerability allows an unauthenticated attacker to execute arbitrary OS commands by submitting malicious payload to an open port. A successful exploit can lead to full compromise of the application.” reads the advisory published by Onapsis. “As a temporary workaround, customers should add P4 port filtering at the ICM level to prevent unknown hosts from connecting to the P4 port. “
Note #3643865 fixes an insecure file operations flaw, tracked as CVE-2025-42922 (CVSS score of CVSS 9.9), where non-admin users could upload and execute arbitrary files, risking full system compromise.
SAP also released HotNews Note #3302162 to fix a Directory Traversal flaw, tracked as CVE-2023-27500, in NetWeaver AS ABAP (CVSS score of 9.6). Released in March 2023, it’s now updated with new fixes.
The fourth HotNews issued by SAP addressed a missing authentication check, tracked as CVE-2025-42958 (CVSS score 9.1), in SAP NetWeaver BC-OP-AS4.
The remaining security notes resolve high, medium- and low-severity issues.
It’s unclear if any of these vulnerabilities are being exploited in attacks in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SAP NetWeaver flaw)
