CVE-2025-42986

MEDIUM EPSS 10.2%
Published Jul 8, 202511mo ago · Modified Jun 17, 20261w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Jul 8, 2025 11mo ago
Last Modified Jun 17, 2026 1w ago

Description

Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
10.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 10

VendorProductVersionRange
sapsap_basis700any
sapsap_basis701any
sapsap_basis702any
sapsap_basis731any
sapsap_basis740any
sapsap_basis750any
sapsap_basis751any
sapsap_basis752any
sapsap_basis753any
sapsap_basis754any

References 2

  • me.sap.com https://me.sap.com/notes/3626440
    Permissions Required
  • url.sap https://url.sap/sapsecuritypatchday
    Patch

Remediation

  • url.sap https://url.sap/sapsecuritypatchday
    Patch