CVE-2025-42902

Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it has a low impact on the availability but no impact on the confidentiality and integrity.

• CWE-476

• https://me.sap.com/notes/3627308
• https://url.sap/sapsecuritypatchday

Published

Oct 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-42895Due to insufficient validation of connection property values…6.9
• CVE-2025-42896SAP BusinessObjects Business Intelligence Platform lets an u…5.4
• CVE-2025-42897Due to information disclosure vulnerability in anonymous API…5.3
• CVE-2025-42899SAP S4CORE (Manage journal entries) does not perform necessa…4.3
• CVE-2025-4290A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-42901SAP Application Server for ABAP allows an authenticated atta…5.4
• CVE-2025-42903A vulnerability in SAP Financial Service Claims Management R…4.3
• CVE-2025-42904Due to an Information Disclosure vulnerability in Applicatio…6.5
• CVE-2025-42906SAP Commerce Cloud contains a path traversal vulnerability t…5.3
• CVE-2025-42907SAP BI Platform allows an attacker to modify the IP address …4.3
• CVE-2025-42908Due to a Cross-Site Request Forgery (CSRF) vulnerability in …5.4
• CVE-2025-42909SAP Cloud Appliance Library Appliances allows an attacker wi…3