Pierluigi Paganini
June 10, 2025
SAP June 2025 Security Patch addressed a critical NetWeaver vulnerability, tracked as CVE-2025-42989 (CVSS score of 9.6), allowing threat actors to bypass authorization checks and escalate their privileges.
“RFC inbound processing does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.” reads the advisory. “On successful exploitation the attacker could critically impact both integrity and availability of the application.”
The flaw resides in SAP’s Remote Function Call (RFC) framework lets authenticated attackers bypass key checks and escalate privileges, risking app integrity and availability.
“SAP Security Note #3600840, tagged with a CVSS score of 9.6, patches a critical Missing Authorization Check vulnerability in the Remote Function Call (RFC) framework of SAP NetWeaver Application Server AS ABAP.” reads the report published by security firm Onapsis. “Under certain conditions, authenticated attackers can bypass the standard authorization check on authorization object S_RFC when using transactional (tRFC) or queued RFCs (qRFC), leading to an escalation of privileges. This allows an attacker to critically impact the application’s integrity and availability.”
June 2025 Security Patch Day addressed a total of five high-severity flaws:
The software giant also fixed six other medium-severity issues, and two low-severity bugs.
The advisory published by SAP does not mention any attacks exploiting the above vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, June 2025 Security Patch Day)
