CVE-2025-42986

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver and ABAP Platform	SAP_BASIS 700; SAP_BASIS 701; SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; SAP_BASIS 751; SAP_BASIS 752; SAP_BASIS 753; SAP_BASIS 754

References

https://me.sap.com/notes/3626440Permissions Required
https://url.sap/sapsecuritypatchdayPatch

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-429874.3SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the CVE-2025-429885.3Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints CVE-2025-429899.6RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On CVE-2025-42999.8A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been rated as critical. This issue affects the function setSchedWifi of CVE-2025-429903.0Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redir CVE-2025-429914.3SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to dele CVE-2025-429926.9SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to expl CVE-2025-429936.7Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Bind CVE-2025-429947.5SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation i CVE-2025-429957.5SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the CVE-2025-429965.6SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticat CVE-2025-429976.6Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the applicat