Vulnerability Details CVE-2025-42986
Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 13.9%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2025-42986
-
cpe:2.3:a:sap:sap_basis:700
-
cpe:2.3:a:sap:sap_basis:701
-
cpe:2.3:a:sap:sap_basis:702
-
cpe:2.3:a:sap:sap_basis:731
-
cpe:2.3:a:sap:sap_basis:740
-
cpe:2.3:a:sap:sap_basis:750
-
cpe:2.3:a:sap:sap_basis:751
-
cpe:2.3:a:sap:sap_basis:752
-
cpe:2.3:a:sap:sap_basis:753
-
cpe:2.3:a:sap:sap_basis:754