Advisory
On 09.09.2025 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within Java.
SAP Note 3634501 addresses "[CVE-2025-42944] Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)" to prevent insecure deserialization with a hot news risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process, the team suggests.
Risk specification
This note has been updated with the following details: - For additional hardening against deserialization vulnerabilities in AS Java, apply Security Note 3660659. - For queries related to note implementation and applicability, refer to KBA 3663688. -The instructions in the 'Workaround' section have been updated. SAP NetWeaver allows an unauthenticated attacker to submit malicious payloads to an open RMI-P4 port, which may result in arbitrary operating system command execution through insecure deserialization of untrusted Java objects.Solution
SAP NetWeaver now enforces secure deserialization handling and restricts the acceptance of untrusted Java objects via the RMI-P4 module, preventing arbitrary code execution through this interface. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "Ensure hat your system is properly isolated at the network level, with the P4/P4S ports only listening on IP addresses from your internal network. If P4/P4S is exposed with public access, you need to be cautious and apply additional security measures. Steps to execute:1. Ensure only trusted systems are reachable on this interface through network-level controls (e.g., firewall rules).2. Plan and schedule a patch or SP update as soon as possible to eliminate the underlying vulnerability.".
Affected System
SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform. It provides the complete infrastructure for deploying and running Java applications.
- The AS Java Home: SAP Netweaver Application Server Java wiki
- A dedicated SAP NetWeaver 7.40 Application Server for Java Security Guide exists.
The advisory is valid for
- 10.0 [CVE-2025-42944] Security Hardening for Insecure Deserialization in SAP NetWeaver AS Java
- 9.1 [CVE-2025-42966] Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)
- 3.5 [CVE-2025-31672] Deserialization Vulnerability in SAP BusinessObjects (Web Intelligence and Platform Search)
