CVE-2025-42944: SAP SE SAP NetWeaver Rmi-p4

Critical severity, CVSS 10.0. EPSS: 2.9% chance of exploitation in the next 30 days.

Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability.

Affected products

Published 2025-09-09. Last modified 2026-06-17.