CVE-2025-42926: fallo de gravedad media en SAP_SE SAP NetWeaver Application Server Java
Missing Authentication check in SAP NetWeaver Application Server Java
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.3%
SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the system.This vulnerability has a low impact on confidentiality and does not affect the integrity or availability of the server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
SAP_SE · SAP NetWeaver Application Server JavaCVEs relacionadas — SAP_SE SAP NetWeaver Application Server Java
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-42919MEDIUMInformation Disclosure vulnerability in SAP NetWeaver Application Server JavaEPSS 0.5%CVE-2025-0054MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server JavaEPSS 0.3%CVE-2025-0067MEDIUMMissing Authorization check in SAP NetWeaver Application Server JavaEPSS 0.3%CVE-2025-24869MEDIUMInformation Disclosure vulnerability in SAP NetWeaver Application Server JavaEPSS 0.3%CVE-2025-27431MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server JavaEPSS 0.2%CVE-2026-23686LOWCRLF Injection vulnerability in SAP NetWeaver Application Server JavaEPSS 0.2%