CVE-2025-42928

CriticalCVSS 9.1/10Last modified Oct 7, 2026

Description

Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Dec 9, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-429298.1Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database table CVE-2025-42935.4A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /ad CVE-2025-429306.5SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that CVE-2025-429338.8When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This lea CVE-2025-429344.3SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert unt CVE-2025-429354.1The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privile CVE-2025-429365.4The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user rol CVE-2025-429379.8SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could trav CVE-2025-429386.1Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious CVE-2025-429394.3SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from CVE-2025-42944.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HotelRunner B2B allows Cross-Si CVE-2025-429407.5SAP CommonCryptoLib does not perform necessary boundary checks during pre-authentication parsing of manipulated ASN.1 data over the network.