Remote Function Call Exploit in SAP NetWeaver Application Server ABAP
CVE-2025-23186

8.5HIGH

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server Abap
Vendor
CVE Published:
8 April 2025

What is CVE-2025-23186?

A vulnerability in SAP NetWeaver Application Server ABAP allows authenticated attackers to use crafted Remote Function Call (RFC) requests to reach restricted destinations. This could lead to unauthorized access to sensitive credentials for remote services. If exploited, attackers may gain the ability to compromise the affected services, significantly impacting the application's confidentiality, integrity, and availability. Organizations using affected versions are urged to implement the recommended patches to mitigate potential risks.

Affected Version(s)

SAP NetWeaver Application Server ABAP KRNL64NUC 7.22

SAP NetWeaver Application Server ABAP 7.22EXT

SAP NetWeaver Application Server ABAP KRNL64UC 7.22

References

https://me.sap.com/notes/3554667
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-23186 : Remote Function Call Exploit in SAP NetWeaver Application Server ABAP