SAP Solution Manager CVE-2025-42880

Exploitation requires (1) valid authenticated access to the SAP system at low privilege (PR:L) and (2) the ability to call a specific remote-enabled function module (RFC-enabled FM) in SAP Solution Manager, which accepts attacker-controlled input that is not sanitized before being processed as code. Limiting factors: the attacker must already possess SAP credentials and network reachability to the RFC gateway/Solution Manager instance - typically an internal SAP landscape interface rather than an internet-exposed service - so realistic risk is highest for insiders or attackers who have already gained an initial SAP foothold. No user interaction is required (UI:N) and complexity is low (AC:L), so once those access conditions are met exploitation is reliable against affected versions.

This is a genuine high-priority vulnerability, though not a drop-everything emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity attack requiring only low-privilege authentication (PR:L), no user interaction, with a scope change (S:C) and total CIA impact - consistent with code injection (CWE-94) yielding full system control. The signals partly reinforce and partly temper each other: EPSS is 4.50% (91st percentile), meaning exploitation probability is elevated relative to most CVEs but still far from high in absolute terms, and there is no CISA KEV listing and no public exploit identified at time of analysis. The combined picture - critical technical severity but a precondition of valid authentication (PR:L) plus no observed active exploitation - points to a vulnerability that is dangerous in principle but currently exploited rarely or not at all, rather than a widespread opportunistic campaign. Two caveats to verify: the CVSS claims network vector while real exploitation depends on reaching a remote-enabled RFC function module, which is typically internal-network/landscape-facing rather than internet-exposed; and PR:L requires the attacker to already hold a (possibly low-tier) SAP account, so insider or post-foothold scenarios dominate. Patch promptly given the critical impact, but the practical window is gated by SAP account access and RFC reachability.

An attacker holding low-privilege credentials on an SAP landscape invokes a vulnerable remote-enabled function module (RFC) in SAP Solution Manager and supplies crafted input that, due to missing sanitation, is injected and executed as code. This yields full control over the Solution Manager system (confidentiality, integrity, and availability). No public exploit code is identified at time of analysis; the low attack complexity (AC:L) means a working exploit would be straightforward to build once the vulnerable module is identified.