Overview

SAP products are vulnerable to critical vulnerabilities. Exploitation of these vulnerabilities may allow an unauthenticated attacker to execute arbitrary code.

Description

SQL Anywhere Monitor, SAP NetWeaver AS Java, and SAP Solution Manager are affected by the vulnerabilities tracked as CVE-2025-42890, CVE-2025-42944, and CVE-2025-42887 with CVSS scores of 10 and 9.9. The plugins are vulnerable due to hard-coded credentials within their code, deserialization vulnerability in SAP NetWeaver and missing input sanitation. The vulnerabilities allow attackers to send a specially crafted request to gain unauthorized access and execute arbitrary OS commands.

Impact

Successful exploitation of these vulnerabilities may allow the attackers to take control of the affected system.

Solution

Successful exploitation of these vulnerabilities may allow the attackers to take control of the affected system.

References

• 1. https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html