CVE-2025-42963 Details
Description
A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected system. This results in a severe impact on the confidentiality, integrity, and availability of the application and host environment.
A critical vulnerability has been identified in the Log Viewer component of SAP NetWeaver Application Server for Java. This vulnerability allows authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation of this vulnerability can lead to a full compromise of the operating system, giving attackers complete control over the affected system. This poses a severe risk to the confidentiality, integrity, and availability of both the application and the host environment.
Users are advised to review and implement the SAP Security Note associated with this vulnerability. This can be done through the SAP for Me platform, where all security notes are available. For guidance on how to access and apply these security notes, refer to the SAP Security Notes FAQs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2025CISA-ADP
Assessed Jul 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://me.sap.com/notes/3621771 | [email protected] | Permission RequiredVendor |
| https://url.sap/sapsecuritypatchday | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SAP NetWeaver Application Server | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2025 | New CVE Received | [email protected] |