CVE-2025-42926

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the system.This vulnerability has a low impact on confidentiality and does not affect the integrity or availability of the server.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-429273.4SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of kno CVE-2025-429289.1Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code executi CVE-2025-429298.1Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database table CVE-2025-42935.4A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /ad CVE-2025-429306.5SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that CVE-2025-429338.8When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This lea CVE-2025-429344.3SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert unt CVE-2025-429354.1The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privile CVE-2025-429365.4The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user rol CVE-2025-429379.8SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could trav CVE-2025-429386.1Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious CVE-2025-429394.3SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from