CVE-2025-42964

—

CVSS 3.1

9.1 critical

EPSS

<1%p52

Published

Jul 8, 2025 (Jul 8, 2025)

Modified

Jun 17, 2026

Description

SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

Weakness: CWE-502
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news4 stories

Exploit weaponizes SAP NetWeaver bugs for full system compromise

Security AffairsAug 20, 00:01 UTC · Aug 20, 2025Exploit / PoC in the wildCVE-2025-31324 CVE-2025-42999 CVE-2025-30012+4 CVEs1

Exploit for critical SAP Netweaver flaws released (CVE-2025-31324, CVE-2025-42999)

Help Net SecurityAug 20, 00:00 UTC · Aug 20, 2025Vulnerability in the wildCVE-2025-31324 CVE-2025-42999 CVE-2025-30012+4 CVEs

Public Exploit for Chained SAP Flaws Exposes Unpatched Systems to Remote Code Execution

The Hacker NewsAug 19, 17:30 UTC · Aug 19, 2025Vulnerability CVE-2025-31324 CVE-2025-42999 CVE-2025-30012+4 CVEs

⚡ Weekly Recap: Scattered Spider Arrests, Car Exploits, macOS Malware, Fortinet RCE and More

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2025Ransomware CVE-2025-25257 CVE-2025-25251 CVE-2025-31365+36 CVEs1