Full Report
SAP has rolled out security fixes for 13 new security issues, including additional hardening for a maximum-severity bug in SAP NetWeaver AS Java that could result in arbitrary command execution. The vulnerability, tracked as CVE-2025-42944, carries a CVSS score of 10.0. It has been described as a case of insecure deserialization. "Due to a deserialization vulnerability in SAP NetWeaver, an
Analysis Summary
# Vulnerability: Critical Insecure Deserialization in SAP NetWeaver AS Java Leading to RCE
## CVE Details
- CVE ID: CVE-2025-42944
- CVSS Score: 10.0 (Critical)
- CWE: Insecure Deserialization
## Affected Systems
- Products: SAP NetWeaver AS Java
- Versions: Not explicitly listed, but refers to a bug patched in the October 2025 SAP Security Notes cycle.
- Configurations: Systems exposing the RMI-P4 module on an open port.
## Vulnerability Description
This vulnerability is a case of insecure deserialization within the SAP NetWeaver Application Server Java (AS Java). An unauthenticated attacker can exploit this flaw by submitting a malicious payload via the RMI-P4 module to an open port. Successful exploitation allows for the deserialization of untrusted Java objects, leading to arbitrary operating system (OS) command execution. This impacts the confidentiality, integrity, and availability of the affected application.
## Exploitation
- Status: No evidence of being exploited in the wild, but a patch was quickly released following an initial fix in the previous month, suggesting high confidence in exploitability.
- Complexity: Low (Unauthenticated, remote access via open port).
- Attack Vector: Network
## Impact
- Confidentiality: High
- Integrity: High
- Availability: High
## Remediation
### Patches
- SAP has released security fixes as part of the October 2025 Security Notes. Users should apply the latest relevant patches from SAP.
- Note: An earlier patch was released, and the current fix provides *additional* safeguards.
### Workarounds
- Implement the recommended hardening measures suggested by security researchers (Onapsis/Pathlock), which involve configuring a JVM-wide filter (`jdk.serialFilter`) to prevent the deserialization of specific risky classes and packages. This filter should include mandatory and optional blocking lists defined in collaboration with the ORL (Open-Source Research Lab, implied).
## Detection
- **Indicators of Compromise:** Look for unexpected outbound network connections or process execution originating from the SAP NetWeaver Java host, particularly targeting the RMI-P4 port.
- **Detection methods and tools:** Monitor network traffic directed at RMI ports for unusual serialized Java object payloads. Monitor system logs for unauthorized OS command executions originating from the Java process environment.
## References
- Vendor Advisories: SAP October 2025 Security Notes (Link provided in article text: `https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2025.html`)
- CVE Record: `https://www.cve.org/CVERecord?id=CVE-2025-42944`
- Analysis/Context: `https://onapsis.com/blog/sap-security-patch-day-october-2025/`
- Analysis/Context: `https://pathlock.com/blog/security-alerts/sap-patchday-october-2025/`