New SAP Net Weaver Bug Lets Attackers Take Over Servers Without Login

Summary: SAP patched 13 security issues, including CVE-2025-42944, a CVSS 10.0 insecure deserialization flaw in SAP NetWeaver AS Java that lets an unauthenticated attacker submit a malicious payload through the RMI-P4 module on an open port and achieve arbitrary OS command execution. The update adds a JVM-wide jdk.serialFilter to block designated classes from being deserialized, and also covers CVE-2025-42937 (CVSS 9.8, directory traversal in SAP Print Service) and CVE-2025-42910 (CVSS 9.0, unrestricted file upload in SAP Supplier Relationship Management).
Bottom line: A 10.0-rated flaw that needs no login and ends in OS command execution sits on an open port in NetWeaver AS Java, and Pathlock's Jonathan Stross notes the P4/RMI chain remains the major risk - so the JVM filter is a second layer, not a substitute for patching.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-42910 CVE-2025-42937 CVE-2025-42944
Related: SAP Patches Critical Net Weaver (CVSS Up to 10.0) and High-Severity S/4HANA Flaws Cyber Risks ·
⚡ Weekly Recap: Bootkit Malware, AI-Powered Attacks, Supply Chain Breaches, Zero-Days & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026