CVE-2025-42943 Information Disclosure in SAP GUI for Windows
An attacker with developer authorization can leak NTLM hashes by triggering UNC path calls in SAP GUI for Windows, compromising credential confidentiality.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-42943?
CVE-2025-42943 is a medium-severity vulnerability in SAP_SE SAP GUI for Windows, published on 12 Aug 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
SAP GUI for Windows may allow the leak of NTML hashes when specific ABAP frontend services are called with UNC paths. For a successful attack, the attacker needs developer authorization in a specific Application Server ABAP to make changes in the code, and the victim needs to execute by using SAP GUI for Windows. This could trigger automatic NTLM authentication, potentially exposing hashed credentials to an attacker. As a result, it has a high impact on the confidentiality.
Weakness: CWE-250
Which versions are affected by CVE-2025-42943?
How do I fix CVE-2025-42943?
No fix has been published for CVE-2025-42943 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-42943 being exploited?
There is no known exploitation of CVE-2025-42943 in the wild and no public exploit code.
Sources
Also known as GHSA-3wph-gw9m-m3mm.