CVE-2025-42936: sap_se sap netweaver application server for abap Incorrect Privilege Assignment

Vulnerability summary

CVE-2025-42936 is a medium (CVSS 5.4) Incorrect Privilege Assignment vulnerability in sap_se sap netweaver application server for abap. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.7% of scored vulnerabilities.

Timeline

1. 12-08-2025
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.