SAP SE SAP NetWeaver vulnerabilities

2 CVEs affecting SAP SE SAP NetWeaver, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-42958, published 2025-09-09.

More from SAP SE.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-42958, published 2025-09-09. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as…
• CVE-2025-31331, published 2025-04-08. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the ABAP system, the…