CVE-2025-42996 Multiple vulnerabilities in SAP MDM Server
Attackers can hijack client sessions to access or modify data and degrade server performance without re-authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-42996?
CVE-2025-42996 is a medium-severity authentication bypass vulnerability in SAP_SE SAP MDM Server, published on 10 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the ability to access or modify non-sensitive information or consume sufficient resources which could degrade the performance of the server causing low impact on confidentiality, integrity and availibility of the application.
Weakness: CWE-590
Which versions are affected by CVE-2025-42996?
How do I fix CVE-2025-42996?
No fix has been published for CVE-2025-42996 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-42996 being exploited?
There is no known exploitation of CVE-2025-42996 in the wild and no public exploit code.
Sources
Also known as GHSA-q73c-hmcg-m3vx.