CVE-2025-42902: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

A memory corruption vulnerability (CVE-2025-42902) was discovered in SAP NetWeaver AS ABAP and ABAP Platform, disclosed on October 13, 2025. The vulnerability allows unauthenticated attackers to send corrupted SAP Logon Tickets or SAP Assertion Tickets to the SAP application server, leading to server process crashes (NVD, GBHackers).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS 3.1 base score of 5.3 (Medium). The flaw occurs during ticket parsing when the SAP application server attempts to process malformed ticket input, resulting in a NULL pointer dereference that causes work process termination. The vulnerability affects multiple kernel versions including KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77, 7.89, 7.93, 9.14, 9.15, and 9.16 (GBHackers).

The vulnerability has a low impact on system availability through work process crashes, with no impact on confidentiality or integrity. Repeated exploitation can cause denial-of-service conditions by continuously crashing server processes. Since the vulnerability requires no authentication or user interaction, it can be exploited remotely over the network (NVD, GBHackers).

SAP has released security note 3627308 and patches as part of its October 2025 patch day. As a temporary workaround, organizations can block incoming ticket parsing by disabling external logon ticket acceptance on the SAP ICM component, though this may disrupt legitimate federated logins. Additional recommended measures include regular security posture reviews and network-level filtering of SAP interfaces (GBHackers).