CVE-2025-42902

Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it has a low impact on the availability but no impact on the confidentiality and integrity.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - cna@sap.com

Published

2025-10-14

Last modified

2026-10-08

Weaknesses

CWE-476

Affected products

• Sap Netweaver As Abap And Abap Platform (Sap Se)

References

• https://me.sap.com/notes/3627308
• https://url.sap/sapsecuritypatchday