CVE-2025-42884: SAP SE SAP NetWeaver Enterprise Portal

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.

Affected products

• SAP SE SAP NetWeaver Enterprise Portal

Published 2025-11-11. Last modified 2026-06-17.