CVE-2025-42890 Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)
Hardcoded credentials in SQL Anywhere Monitor allow attackers to gain unauthorized access and execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-42890?
CVE-2025-42890 is a critical vulnerability in SAP_SE SQL Anywhere Monitor (Non-Gui), published on 11 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system.
Weakness: CWE-798
Which versions are affected by CVE-2025-42890?
How do I fix CVE-2025-42890?
No fix has been published for CVE-2025-42890 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-42890 being exploited?
There is no known exploitation of CVE-2025-42890 in the wild and no public exploit code.
Sources
Also known as GHSA-22x4-qh5g-vv78.