PT-2025-28282 · Sap · Sap Netweaver Application Server For Java Log Viewer

Published 2025-07-07 · Updated 2025-07-23 · CVE-2025-42963

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application server for Java (affected versions not specified)

Description: A critical issue in the Log Viewer component enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected system. This results in a severe impact on the confidentiality, integrity, and availability of the application and host environment.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-10641

CVE-2025-42963

Affected Products

Sap Netweaver Application Server For Java Log Viewer

References · 11

• https://bdu.fstec.ru/vul/2025-10641 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42963 · Security Note
• https://twitter.com/jmdevlabs/status/1948136483577069725 · Twitter Post
• https://t.me/netlas/431 · Telegram Post
• https://twitter.com/cracbot/status/1944351139031633971 · Twitter Post
• https://me.sap.com/notes/3621771 · Note
• https://twitter.com/Netlas_io/status/1942497574839054717 · Twitter Post
• https://t.me/brutsecurity/2053 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/1942418296701104591 · Twitter Post