Missing Authorization Check in SAP S/4HANA Enterprise Event Enablement

CVE-2025-42993

What is CVE-2025-42993?

A vulnerability exists in SAP S/4HANA's Enterprise Event Enablement, where attackers with access to the Inbound Binding Configuration can create an RFC destination and assign it to a high-privilege user. This exploitation can result in unauthorized code execution under the privileges of the compromised user, posing serious risks to the system's confidentiality and integrity. Remediation is crucial to safeguard sensitive data and maintain system integrity.

References