SAP June 2025 Security Patch Day fixed critical NetWeaver bug

SAP fixed a critical NetWeaver flaw that let attackers bypass authorization and escalate privileges. Patch released in June 2025 Security Patch.

SAP June 2025 Security Patch addressed a critical NetWeaver vulnerability, tracked as CVE-2025-42989 (CVSS score of 9.6), allowing threat actors to bypass authorization checks and escalate their privileges.

“RFC inbound processing does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.” reads the advisory. “On successful exploitation the attacker could critically impact both integrity and availability of the application.”

The flaw resides in SAP’s Remote Function Call (RFC) framework lets authenticated attackers bypass key checks and escalate privileges, risking app integrity and availability.

“SAP Security Note #3600840, tagged with a CVSS score of 9.6, patches a critical Missing Authorization Check vulnerability in the Remote Function Call (RFC) framework of SAP NetWeaver Application Server AS ABAP.” reads the report published by security firm Onapsis. “Under certain conditions, authenticated attackers can bypass the standard authorization check on authorization object S_RFC when using transactional (tRFC) or queued RFCs (qRFC), leading to an escalation of privileges. This allows an attacker to critically impact the application’s integrity and availability.”

June 2025 Security Patch Day addressed a total of five high-severity flaws:

• CVE-2025-42982 (CVSS score of 8.8) – Information Disclosure in SAP GRC (AC Plugin)
• CVE-2025-42983 (CVSS score of 8.5) – Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis
• CVE-2025-23192 (CVSS score of 8.2) – Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)
• CVE-2025-42977 (CVSS score of 7.6) – Directory Traversal vulnerability in SAP NetWeaver Visual Composer
• CVE-2025-42994 (CVSS score of 7.5) – Multiple vulnerabilities in SAP MDM Server

The software giant also fixed six other medium-severity issues, and two low-severity bugs.

The advisory published by SAP does not mention any attacks exploiting the above vulnerabilities.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, June 2025 Security Patch Day)