CVE-2025-42904
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
An Information Disclosure vulnerability in Application Server ABAP allows an authenticated attacker to read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity or availability.
Risk Assessment
An authenticated attacker could access sensitive data, causing a high impact on confidentiality but not affecting integrity or availability. This may lead to the leakage of sensitive business information.
Recommendation
Apply available SAP patches for Application Server ABAP that address the information disclosure issue. Restrict authenticated user permissions to the minimum necessary.
Other vulnerabilities in Application Server ABAP
See all- CVE-2026-0506High
A Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform allows an authenticated attacker to misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow writing or modifying data accessible via FORMs and invoking system functionality, resulting in high impact on integrity and availability, while confidentiality remains unaffected.
- CVE-2026-44751High
The ABAP application server does not perform necessary authorization checks for an authenticated user, allowing execution of a report generation command that can overwrite another user's data, leading to privilege escalation. This has high impact on integrity, low on availability, and no impact on confidentiality.
Original NVD description (English source)
Due to an Information Disclosure vulnerability in Application Server ABAP, an authenticated attacker could read unmasked values displayed in ABAP Lists. Successful exploitation could lead to unauthorized disclosure of data, resulting in a high impact on confidentiality without affecting integrity or availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS