Loading story…
A critical vulnerability, tracked as CVE-2025-42890, was discovered in the non-GUI variant of SAP's SQL Anywhere Monitor. The flaw stems from hardcoded credentials being embedded in the application's code, which exposes sensitive resources and functionality to unauthorized users. This vulnerability allows attackers to potentially achieve arbitrary code execution, posing a severe risk to the confidentiality, integrity, and availability of affected systems. The vulnerability has been assigned the maximum CVSS score of 10.0, highlighting its critical nature and the urgency for remediation.
SAP addressed this issue in its November security updates, which also included fixes for other high-severity vulnerabilities. The SQL Anywhere Monitor is commonly used by organizations to oversee distributed or remote databases, and the non-GUI component is often deployed on unattended appliances, increasing the risk of exploitation due to limited oversight. SAP has urged customers to apply the security updates promptly to mitigate the risk associated with this flaw and prevent potential unauthorized access or system compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
As part of the fix for CVE-2025-42890, SAP's patch removed SQL Anywhere Monitor entirely. SAP also advised customers unable to patch immediately to stop using SQL Anywhere Monitor and delete existing monitor database instances as a temporary mitigation.
On 2025-11-11, SAP published a security advisory as part of its November 2025 updates for CVE-2025-42890, a maximum-severity hardcoded-credentials flaw in SQL Anywhere Monitor (Non-GUI) version 17.0. The vulnerability could allow unauthenticated access and arbitrary code execution, and SAP stated there was no evidence of active exploitation at disclosure time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecvefeed.io
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcearcticwolf.com
Open sourcearcticwolf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical code injection vulnerability, tracked as CVE-2025-42880, has been identified in SAP Solution Manager. The flaw arises from insufficient input sanitation, allowing authenticated attackers to inject malicious code via remote-enabled function modules. Successful exploitation could grant attackers full control over the affected system, severely impacting confidentiality, integrity, and availability. The vulnerability is remotely exploitable and has been assigned a CVSS score of 9.9, indicating its high severity. SAP has released a final patch to address this issue, emphasizing the risk of full system compromise if left unremediated. Security researchers and SAP have highlighted the urgency of applying the patch, as exploitation could lead to complete takeover of SAP Solution Manager environments. Organizations using SAP Solution Manager are strongly advised to review their deployments and apply the latest security updates to mitigate the risk. No specific affected product versions have been listed, but the vulnerability is confirmed to be present in the platform. The disclosure underscores the importance of prompt patch management in enterprise SAP environments to prevent potential attacks leveraging this critical flaw.
Jun 29, 2026
SAP disclosed **CVE-2026-44747**, a critical memory corruption vulnerability in **SAP NetWeaver Application Server ABAP**, and published remediation guidance in **Security Note `3747367`** as part of its Security Patch Day materials. The flaw is classified as **CWE-787** and affects multiple SAP ABAP kernel releases, including `KRNL64NUC 7.22`, `7.22EXT`, `KRNL64UC 7.22`, `7.53`, `7.54`, `7.77`, `7.89`, `7.93`, and `9.16` through `9.20`. The vulnerability can be exploited remotely by an authenticated attacker with low privileges and carries a **CVSS v3.1 score of 9.1** (`AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`). Successful exploitation could cause unauthorized data access, data modification, privilege escalation, or system unavailability. Public reporting said there was **no confirmed active exploitation** at the time of disclosure, but the impact profile makes patching affected SAP environments a priority.
Jul 23, 2026
SAP has released security updates addressing 13 newly identified vulnerabilities across its product suite, with particular focus on a maximum-severity flaw in SAP NetWeaver AS Java. The most critical vulnerability, tracked as CVE-2025-42944 and assigned a CVSS score of 10.0, is an insecure deserialization issue that allows unauthenticated attackers to execute arbitrary operating system commands. This flaw can be exploited via the RMI-P4 module by submitting a malicious payload to an open port, potentially compromising the confidentiality, integrity, and availability of affected systems. SAP initially addressed this vulnerability in a previous update, but the latest patch introduces additional hardening measures, including a JVM-wide filter (jdk.serialFilter) to block the deserialization of dangerous classes. The list of classes and packages to be filtered was developed in collaboration with the Onapsis Research Labs and is divided into mandatory and optional sections to maximize protection. In addition to CVE-2025-42944, SAP has patched a directory traversal vulnerability in SAP Print Service (CVE-2025-42937, CVSS 9.8), which could allow unauthenticated attackers to overwrite system files by exploiting insufficient path validation. Another critical issue, CVE-2025-42910 (CVSS 9.0), affects SAP Supplier Relationship Management and involves unrestricted file upload, enabling authenticated attackers to upload arbitrary files, including potentially malicious executables. These vulnerabilities collectively pose significant risks to enterprise environments running SAP solutions, as successful exploitation could lead to system compromise, data loss, or service disruption. SAP has stated that there is currently no evidence of these vulnerabilities being exploited in the wild. Security experts and SAP have emphasized the importance of promptly applying the latest patches to mitigate the risk of exploitation. The additional hardening for the deserialization flaw is particularly notable, as it provides a more robust defense against a class of attacks that have historically been difficult to fully remediate. Organizations are advised to review their SAP deployments, ensure all relevant updates are applied, and follow SAP’s guidance on blocking risky deserialization classes. The disclosure and remediation of these vulnerabilities highlight the ongoing challenges in securing complex enterprise software platforms. SAP’s collaboration with security researchers and the implementation of layered defenses demonstrate a proactive approach to addressing critical security issues. Enterprises relying on SAP NetWeaver and related products should prioritize these updates as part of their regular patch management processes. Failure to address these vulnerabilities could leave systems exposed to remote attacks that require no authentication, significantly increasing the risk profile for affected organizations. The security community continues to monitor for any signs of exploitation and urges vigilance in maintaining up-to-date SAP environments.
Jun 29, 2026