What is the CVSS score of CVE-2025-42928?

CVE-2025-42928 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 9.5%.

Which versions of SAP jConnect are affected by CVE-2025-42928?

SAP jConnect, the JDBC driver for SAP ASE, contains a critical remote code execution vulnerability (CVE-2025-42928) that an authenticated high-privileged user can trigger through unsafe…

How to fix or mitigate CVE-2025-42928?

Within 24 hours, inventory all SAP ASE and SAP jConnect (JDBC driver) deployments, record exact jConnect and SAP ASE versions, and identify all high-privileged database accounts that could trigger the vulnerability. Restrict network access to SAP ASE listener ports (e.g., 5000) to trusted application servers only, and review database and JDBC logs for unusual deserialization or connection activity. Within 7 days, enforce least privilege for all SAP ASE high-privilege accounts, rotate credentials for those accounts, enable enhanced logging/monitoring for jConnect connections, and apply any SAP vendor-provided workarounds or security notes for CVE-2025-42928; where no patch is available, block untrusted clients at the network layer and limit jConnect usage to required applications. Within 30 days, re-check SAP security advisories for a vendor-released patch, test it in a non-production environment, and deploy to all affected SAP ASE/jConnect instances; if a patch remains unavailable, maintain compensating controls, perform a focused forensic review of high-privileged database activity, and update the incident response plan for JDBC deserialization threats.

SAP jConnect CVE-2025-42928

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-12-09 cna@sap.com

RCE Deserialization SAP

9.1

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

High-privileged user explicitly required so PR:H; network-reachable crafted-input deserialization with no UI gives AV:N/AC:L/UI:N, and RCE escaping the component justifies S:C with full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 20:35 vuln.today

CVE Published

Dec 09, 2025 - 16:17 cve.org

CRITICAL 9.1

DescriptionCVE.org

Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.

AnalysisAI

Remote code execution in SAP jConnect, SAP's JDBC driver for SAP ASE (Sybase), lets a high-privileged user trigger unsafe deserialization with specially crafted input, yielding complete loss of confidentiality, integrity, and availability on the affected system. The CVSS 9.1 score reflects network reachability and no user interaction, but the PR:H vector and the vendor's unspecified 'under certain conditions' precondition mean realistic risk is substantially lower in environments where high-privilege access is tightly controlled. EPSS is elevated at 9.48% (95th percentile), yet no public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).

Technical ContextAI

The flaw is a classic unsafe deserialization issue (CWE-502) in SAP jConnect, a pure-Java JDBC driver used by applications to connect to SAP ASE/Sybase databases. When a privileged user supplies specially crafted input to a deserialization path in the driver, attacker-controlled serialized data can be reconstructed into arbitrary object graphs, and if those classes expose dangerous gadget chains (e.g., reflective invocation or command execution during readObject), the result is remote code execution within the Java process hosting the driver. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H shows a low-complexity, network-reachable attack requiring high privileges, no user interaction, and a scope change - meaning the compromise can escape the driver's original security authority and affect other components or the host itself. The root cause class, CWE-502, places remediation emphasis on validating or avoiding deserialization of untrusted data rather than on simple input filtering. The vendor characterizes exploitability as conditional ('under certain conditions'), and those preconditions are not enumerated in the available data, so the exact jConnect versions and deployment configurations at risk must be confirmed against SAP Note 3685286.

Affected ProductsAI

SAP jConnect, SAP's JDBC driver for SAP ASE/Sybase, is the affected component; no CPE string or explicit version range was supplied in the available data, and SAP states the driver is vulnerable only 'under certain conditions.' The authoritative scope definition - affected releases, supported JDBC driver builds, and the configuration prerequisites - is contained in SAP Note 3685286 (https://me.sap.com/notes/3685286), with patched builds expected to be published through SAP Security Patch Day (https://url.sap/sapsecuritypatchday). Because the version boundary is not enumerated in the available data, administrators should treat any jConnect deployment that exposes a deserialization entry point to high-privileged users as potentially affected until the note confirms otherwise, and should inventory driver versions bundled inside application servers, middleware, and third-party products rather than assuming only direct installations are in scope.

RemediationAI

The primary fix is to apply the patched jConnect build referenced in SAP Note 3685286 (https://me.sap.com/notes/3685286) and to track the corresponding release on SAP Security Patch Day (https://url.sap/sapsecuritypatchday); patch status is 'Patch available per vendor advisory' - no exact fixed version number was supplied in the available data, so confirm the specific affected and fixed driver builds directly in the note before closing the finding. If immediate patching is not feasible, the most effective compensating control is to restrict network reachability to the ASE/jConnect listener ports so only trusted application servers can connect, since the attack vector is AV:N - the trade-off is that legitimate remote or developer clients outside the allow-list will lose connectivity. In parallel, enforce least privilege and remove or disable high-privilege database accounts that application tiers can use, because exploitation requires PR:H - the trade-off is that applications relying on DBA-level credentials for migrations, batch jobs, or administration will break and must be re-provisioned with narrower roles. Where the driver is embedded in a Java application server, consider JVM-level deserialization protections (class allow-listing or a serialization filter) on the process that loads the driver, accepting that overly broad filters can cause deserialization-based application features to fail and require testing. Because the vendor's 'certain conditions' precondition is undocumented in the available data and no public exploit has been identified at time of analysis, prioritize patching and access restriction on internet-exposed or multi-tenant ASE deployments where high-privilege accounts are shared, and monitor for anomalous JDBC connections or unexpected process spawning from application servers as a detection backstop.