Analysis Summary

CVE-2025-0066 CVSS:9.9

Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application.

CVE-2025-0063 CVSS:8.8

SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.

CVE-2025-0070 CVSS:9.9

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.

CVE-2025-0069 CVSS:7.8

Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate users Windows account could gain higher privileges. With this, he could move laterally within the network and further compromise the active directory of a company. This leads to high impact on confidentiality, integrity and availability of the Windows server.

Impact

• Information Disclosure
• Data Manipulation
• Gain Access

Indicators of Compromise

CVE

• CVE-2025-0066

• CVE-2025-0063

• CVE-2025-0070

• CVE-2025-0069

Affected Vendors

Remediation

Current SAP customers should refer to the SAP note for patch information, available from the SAP Website (login required).

CVE-2025-0066

CVE-2025-0063

CVE-2025-0070

CVE-2025-0069