CVE-2025-0070

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Jan 14, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-00714.9SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with aCVE-2025-00727.8Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-priCVE-2025-00737.8Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-priCVE-2025-00749.8In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead CVE-2025-00759.8In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lCVE-2025-00763.3In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead toCVE-2025-00774.0In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalCVE-2025-00788.8In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to local escalation of privCVE-2025-00797.8In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This couCVE-2025-00807.8In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This coulCVE-2025-00817.5In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This couldCVE-2025-00825.5In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confuse
CVE-2025-0070: Critical severity, CVSS 9.9 | Vulnix