CVE-2025-42989

critical · 9.6

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application.

9.6

CVSS

0.4%

EPSS (exploit prob.)

38th

EPSS percentile

2025-06-10

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Weaknesses

CWE-862

References

https://me.sap.com/notes/3600840
https://url.sap/sapsecuritypatchday

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-42989