CVE-2025-42928

CRITICAL

SAP jConnect - SDK for ASE 16.0.4-16.0.4, 16.1-16.1 - Remote Code Execution via Deserialization

Title source: llm
STIX 2.1

Description

Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.

References (2)

Core 2
Core References

Scores

CVSS v3 9.1
EPSS 0.0198
EPSS Percentile 83.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-502
Status published
Products (2)
SAP_SE/SAP jConnect - SDK for ASE 16.1
SAP_SE/SAP jConnect - SDK for ASE SYBASE_SOFTWARE_DEVELOPER_KIT 16.0.4
Published Dec 09, 2025
Tracked Since Feb 18, 2026