CVE-2025-23186 Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
Authenticated attackers can craft RFC requests to expose remote service credentials, leading to full compromise of the remote service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-23186?
CVE-2025-23186 is a high-severity code injection vulnerability in SAP_SE SAP NetWeaver Application Server ABAP, published on 8 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote service, potentially resulting in a significant impact on the confidentiality, integrity, and availability of the application.
Weakness: CWE-94
Which versions are affected by CVE-2025-23186?
How do I fix CVE-2025-23186?
No fix has been published for CVE-2025-23186 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-23186 being exploited?
There is no known exploitation of CVE-2025-23186 in the wild and no public exploit code.
Sources
Also known as GHSA-frxv-q4xc-g6pg.