CVE-2025-42959: sap se sap netweaver abap server and abap platform Use of Single-factor Authentication

Vulnerability summary

CVE-2025-42959 is a high (CVSS 8.1) Use of Single-factor Authentication vulnerability in sap se sap netweaver abap server and abap platform. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.6% of scored vulnerabilities.

Timeline

1. 08-07-2025
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation could result in complete system compromise, affecting confidentiality, integrity, and availability.

• CWE-308Use of Single-factor AuthenticationThe product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.