Introduction
Attackers with privileged access to SAP ABAP reports can delete the content of arbitrary database tables if authorization groups are not properly configured. The vulnerability is tracked as CVE-2025-42929, carries a CVSS score of 8.1, and directly threatens the integrity and availability of business data managed in SAP. In large enterprises that run financial, operational, and compliance processes on SAP, a flaw like this can cause significant business disruption and data loss.
SAP (Systems, Applications, and Products in Data Processing) is a global leader in enterprise resource planning and business software. Its ABAP (Advanced Business Application Programming) platform runs mission-critical applications for thousands of organizations worldwide. Because the platform is so widely deployed and holds such sensitive data, SAP's security posture is closely watched.
Technical Information
CVE-2025-42929 is caused by missing input validation in ABAP report execution. When a highly privileged user passes crafted input to a vulnerable ABAP report, the system does not properly validate the input's type or content, so the attacker can name arbitrary database tables as targets for deletion. The flaw is exploitable only when the target table is not protected by an authorization group. SAP manages authorization groups through the S_TABU_DIS authorization object.
The root cause is classified as CWE-1287 (Improper Validation of Specified Type of Input). Gaps in the input validation logic let attackers bypass the intended access controls. An attacker first needs a compromised privileged account or insider access, because only users with sufficient rights to execute ABAP reports can exploit the issue. No public code snippets or proof-of-concept exploits are available for this vulnerability.
Affected Systems and Versions
- SAP ABAP environments where database tables are not protected by an authorization group
- Only tables without an authorization group assignment are vulnerable, including tables assigned to the default "&NC&" group
- The vulnerability is present in any SAP system where ABAP reports process input without proper validation and authorization group protections are missing
- The available advisories do not list specific SAP version numbers or product ranges
Vendor Security History
SAP has had several high-profile vulnerabilities in recent years, notably CVE-2025-42957 (critical ABAP code injection, exploited in the wild) and CVE-2025-42950 (code injection in SAP Landscape Transformation). SAP typically responds with coordinated disclosure, a rapid patch release, and detailed security notes. Because SAP's authorization and configuration frameworks are complex, misconfigurations or missing controls can leave significant security gaps, as recurring issues with input validation and authorization enforcement have shown.
