PT-2025-49764 · Sap · Xcelsius+1

Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-42874

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver remote service for Xcelsius (affected versions not specified)

Description An attacker with network access and high privileges can execute arbitrary code on the affected system. This is due to insufficient input validation and improper handling of remote method calls. Exploitation does not require user interaction and could lead to service disruption or unauthorized system control. The issue has a high impact on integrity and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-405

Related Identifiers

BDU:2025-16273

CVE-2025-42874

Affected Products

Sap Netweaver

Xcelsius

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-42874 · Security Note
• https://bdu.fstec.ru/vul/2025-16273 · Security Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/1998225340528001410 · Twitter Post
• https://t.me/CVEtracker/39193 · Telegram Post
• https://me.sap.com/notes/3640185 · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2025.html · Note