CVE-2025-42922

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-429234.3Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to senCVE-2025-429246.1SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redCVE-2025-429254.3Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low CVE-2025-429265.3SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within theCVE-2025-429273.4SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of knoCVE-2025-429289.1Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code executiCVE-2025-429298.1Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tableCVE-2025-42935.4A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /adCVE-2025-429306.5SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters thatCVE-2025-429338.8When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leaCVE-2025-429344.3SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untCVE-2025-429354.1The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privile
CVE-2025-42922: Critical severity, CVSS 9.9 | Vulnix