Introduction
Unrestricted remote code execution in SAP NetWeaver can lead to full compromise of business-critical systems, data exfiltration, and operational disruption. CVE-2025-42944 is a newly disclosed vulnerability in the RMI-P4 module of SAP NetWeaver. An unauthenticated attacker can exploit it, and it carries the maximum CVSS score of 10.0.
About SAP and NetWeaver: SAP SE makes enterprise application software and has over 440,000 customers worldwide. SAP NetWeaver is the base platform for many SAP applications. It provides integration, application server, and communication services for large-scale business environments. Because NetWeaver is so widely used in critical industries, a vulnerability in it has a large impact.
Technical information
CVE-2025-42944 is caused by insecure deserialization in the RMI-P4 module of SAP NetWeaver. The P4 protocol carries remote Java object communication and typically listens on port 5NN04 (where NN is the SAP system number). An attacker can send crafted serialized Java objects to this port. Because validation is missing or insufficient, NetWeaver deserializes these objects without checking their integrity or origin.
When NetWeaver deserializes a malicious payload, attacker-controlled code runs in the context of the SAP NetWeaver process. The attacker can then run arbitrary operating system commands, potentially with high privileges. The attack needs no authentication, so exploitation is feasible from any network segment that can reach the P4 port.
The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). Exploitation typically involves building a gadget chain from available Java classes or SAP libraries to achieve code execution. As of this writing, public sources contain no code snippets or PoC.
Affected systems and versions
- SAP NetWeaver systems with the RMI-P4 module enabled
- Systems exposing the P4 protocol on port 5NN04 (where NN is the SAP system number)
- Public sources do not list specific affected version numbers, so all unpatched NetWeaver deployments using the RMI-P4 module should be considered at risk
Vendor security history
NetWeaver has had several critical vulnerabilities in 2025, including:
- CVE-2025-42964: Deserialization flaw in NetWeaver
- CVE-2025-31324: Visual Composer remote code execution
- CVE-2025-42999: Related deserialization issue
SAP releases security updates on its regular Security Patch Day and publishes detailed security notes. SAP generally patches promptly, but the complexity of SAP landscapes can delay deployment in customer environments.
