SAP Web Dispatcher
CVE-2025-42878
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed testing interface
-
ExploitSend crafted diagnostic request
-
ExecutionAccess internal diagnostics/config data
-
ImpactDisrupt service availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Asset protection level
|
| Exploitation Conditions | Exploitation requires that the internal testing/diagnostic interfaces of SAP Web Dispatcher or ICM be explicitly enabled - these are not intended for, and are not present in, default production configurations, so this non-default setting is the primary gating prerequisite. Attacker reaches the interface over the network without authentication (PR:N), but the vendor vector also specifies high attack complexity (AC:H) and user interaction (UI:R), both of which limit reliable exploitation. The decisive limiting factor for defenders is deployment posture: instances that have never enabled these testing interfaces are not exposed to this vulnerability. |
| Impact | This is a high-CVSS (8.2) issue whose real-world risk is substantially gated by configuration and exploitation complexity. The CVSS vector (AV:N/PR:N) confirms a network-reachable, unauthenticated attack surface with scope change (S:C) and high confidentiality/availability impact, which drives the elevated base score. However, two signals pull hard in the other direction: AC:H (high attack complexity) and the description's explicit precondition that the internal testing interfaces must be 'enabled' - meaning default production deployments are not exposed. The EPSS score is low (0.36%, 28th percentile), consistent with no CISA KEV listing and no public exploit identified at time of analysis, indicating this is not currently subject to widespread opportunistic exploitation. No SSVC decision data was provided in the input. The CVSS vector includes UI:R (user interaction required), which conflicts somewhat with the description's framing of attackers directly sending 'crafted requests' to an interface - this UI:R choice should be verified with SAP, as the description implies direct request-based interaction rather than a victim-triggered action. Net assessment: a genuine concern for organizations that have enabled the testing/diagnostic interfaces, but a low-urgency item for the majority running default production configurations - prioritize configuration auditing over emergency patching unless these interfaces are known to be enabled. |
| Exploit ScenarioDerived | An organization has left SAP Web Dispatcher or ICM internal testing/diagnostic interfaces enabled on an internet- or network-reachable instance. A remote unauthenticated attacker discovers the exposed interface, queries it to harvest diagnostic and configuration data, and sends crafted requests to probe or disrupt the service. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation depends on the specific enabled feature set. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Unauthenticated remote attackers can reach internal testing and diagnostic interfaces in SAP Web Dispatcher and the Internet Communication Manager (ICM) that are not meant for production use, allowing them to read diagnostic data, send crafted requests, and degrade availability, with the strongest impact on confidentiality and availability. The vulnerability carries a high CVSS base score of 8.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H), but exploitation is fundamentally gated by configuration: the affected interfaces exist only when an administrator has explicitly enabled them, and they are absent from default production deployments. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score is low at 0.36% (28th percentile), so real-world risk is heavily concentrated in the minority of instances where these testing interfaces have been turned on.
RemediationAI
Apply the fixes and configuration guidance in SAP Security Note 3684682 (https://me.sap.com/notes/3684682), released via SAP Security Patch Day (https://url.sap/sapsecuritypatchday); because the note does not specify an exact fix version, treat this as a vendor-advisory patch and validate applicability against your Web Dispatcher and ICM/kernel release. Patch availability is per the vendor advisory, so no vendor-released patch version can be independently confirmed here. The most effective and lowest-cost control is to ensure the internal testing and diagnostic interfaces are disabled - instances that never enabled them are not exposed, so audit configuration profiles, instance parameters, and any temporary troubleshooting changes for leftover diagnostic endpoints and remove them; the trade-off is loss of those diagnostic capabilities, which should be obtained through controlled, authenticated channels instead. Where the interfaces cannot be switched off immediately, restrict inbound access to them at the network layer (front-end firewalls, network ACLs, or Web Dispatcher rules) so only trusted management hosts can reach them, accepting that this adds operational overhead and can complicate troubleshooting. Monitoring for requests to diagnostic or testing paths in Web Dispatcher and ICM logs is a useful compensating detection step, and any exposed instance should be reviewed for evidence of diagnostic-data retrieval or service disruption attempts. No public exploit code was identified at time of analysis, and the low EPSS score (0.36%) means exploitation is unlikely to be opportunistic at scale, but configuration hygiene remains the deciding factor.
Affected ProductsAI
SAP Web Dispatcher and the SAP Internet Communication Manager (ICM), the HTTP/protocol-handling components used with SAP NetWeaver-based application servers and S/4HANA landscapes; the exposure applies to instances where the internal testing/diagnostic interfaces have been explicitly enabled, since they are not present in default production configurations. No CPE strings were supplied in the available intelligence, so product identification rests on the vendor's own advisory rather than on standardized CPE mapping. SAP published the relevant guidance under SAP Security Note 3684682 (https://me.sap.com/notes/3684682), issued as part of an SAP Security Patch Day (https://url.sap/sapsecuritypatchday); administrators should match the note to their exact Web Dispatcher and kernel release to confirm which version ranges are covered.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SAP Web Dispatcher is a reverse proxy, load balancer, and entry point for HTTP(S) traffic into SAP NetWeaver and S/4HANA systems, and the Internet Communication Manager (ICM) is the component that handles HTTP, HTTPS, and other protocols inside the SAP application server; both can expose internal testing and diagnostic endpoints that were intended only for development or troubleshooting rather than production traffic. This issue maps to CWE-1244 (Internal Asset Exposed to Unsafe Debug Access Level or Functionality), meaning the root cause is not a classic memory-safety or injection flaw but the presence of a debug/diagnostic functionality whose access level or exposure is unsafe when activated - the asset is reachable over the network and offers functionality that was never designed to be exposed to untrusted callers. The CVSS vector confirms the network attack path (AV:N), no required privileges (PR:N), and a scope change (S:C) with high confidentiality and availability impact but only low integrity impact (C:H/I:L/A:H), which is consistent with read-oriented diagnostics plus the ability to disrupt service rather than to arbitrarily modify application data. Vendor and independent assessments agree on those impact metrics; they differ only in the user-interaction metric, where the assessed vector sets UI:N while the vendor vector states UI:R, and both retain high attack complexity (AC:H), reflecting that exploitation is neither trivial nor reliably repeatable.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:H
Network-reachable and unauthenticated (AV:N/PR:N) but the required non-default enabling of testing interfaces justifies AC:H; UI:N chosen because the description shows direct crafted-request interaction with no victim action.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
DescriptionCVE.org
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high impact on confidentiality, availability and low impact on integrity and of the application.
Executive ViewAI
SAP Web Dispatcher and the Internet Communication Manager (ICM) can expose internal testing and diagnostic interfaces to unauthenticated network users whenever administrators have turned those interfaces on, creating a path to disclosure of diagnostic data and to service degradation on affected systems. The exposure is not present in default production configurations and no public exploit has been identified, so organizational risk is concentrated in the subset of internet-facing or partner-reachable instances where these non-production interfaces remain enabled. Because no vendor patch is currently available, leadership attention should focus on inventorying and disabling these interfaces rather than on patch deployment timelines.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the testing and diagnostic interfaces in SAP Web Dispatcher and ICM unless strictly required, since they are absent from default production deployments; restrict network access to these services through firewall rules, segmentation, or reverse-proxy controls so only trusted administrative networks can reach them; monitor and alert on requests to diagnostic endpoints; and reduce the internet exposure of affected instances pending a vendor fix. Exploitation requires the affected interfaces to be enabled, so configuration hardening directly removes the exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB