CVE-2025-42919
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
An information disclosure vulnerability exists in SAP NetWeaver Application Server Java. An unauthenticated attacker can access internal metadata files via manipulated URLs by inserting arbitrary path components.
Risk Assessment
Partial compromise of information confidentiality may occur through unauthorized access to sensitive application metadata.
Recommendation
Apply the SAP patch or restrict access to the application server.
Other vulnerabilities in SAP NetWeaver Application Server Java
See all- CVE-2026-40128Critical
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to manipulate parameters in an HTTP logon request, enabling path traversal and processing of the included file. This can lead to reading, modifying, or denying access to data.
- CVE-2026-58235Medium
SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected component, though no specific exploit is currently known. Successful exploitation could result in low impact on confidentiality, integrity, and availability of the system.
- CVE-2026-44752High
A vulnerability in SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript via crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, enabling the attacker to access sensitive session information and modify non-sensitive data displayed in the client's browser.
Original NVD description (English source)
Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access to sensitive application metadata. This results in a partial compromise of the confidentiality of the information without affecting the integrity or availability of the application server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS