Privilege Escalation via Unrestricted Authorization in SAP NetWeaver AS ABAP
CVE-2025-42936 Published on August 12, 2025

Missing Authorization check in SAP NetWeaver Application Server for ABAP
The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.

NVD

Vulnerability Analysis

CVE-2025-42936 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Products Associated with CVE-2025-42936

Want to know whenever a new CVE is published for SAP Netweaver Application Server Abap? stack.watch will email you.

SAP Netweaver Application Server Abap

Affected Versions

SAP_SE SAP NetWeaver Application Server for ABAP:

Version SAP_BASIS 700 is affected.
Version SAP_BASIS 701 is affected.
Version SAP_BASIS 702 is affected.
Version SAP_BASIS 731 is affected.
Version SAP_BASIS 740 is affected.
Version SAP_BASIS 750 is affected.
Version SAP_BASIS 751 is affected.
Version SAP_BASIS 752 is affected.
Version SAP_BASIS 753 is affected.
Version SAP_BASIS 754 is affected.
Version SAP_BASIS 755 is affected.
Version SAP_BASIS 756 is affected.
Version SAP_BASIS 757 is affected.
Version SAP_BASIS 758 is affected.
Version SAP_BASIS 816 is affected.

Exploit Probability

EPSS

0.03%

Percentile

9.61%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.