# CVE-2025-42922: SAP NetWeaver - Arbitrary File Upload

> Live exploitation tracking for CVE-2025-42922 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-42922

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.9
- **Public exploit available:** Yes
- **Affected products:** SAP NetWeaver
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** enterprise_software

## Description

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system.

## CrowdSec analysis

[CVE-2025-42922](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-42922) is a vulnerability in SAP NetWeaver that allows an authenticated non-administrative user to upload an arbitrary file by exploiting a flaw in an available service. This file, when executed, could lead to a complete compromise of the system's confidentiality, integrity, and availability.

CrowdSec has been tracking this vulnerability and its exploits since 11th of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-42922 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

The exploit details for this CVE have not been publicly released. This description will be updated as more information becomes available.

## Timeline

- 2025-09-09: CVE Published. CVE-2025-42922 is published to NVD.
- 2025-09-11: Rule Released. CrowdSec releases a rule to detect CVE-2025-42922 exploitation attempts against the CrowdSec Network.

## References

- https://url.sap/sapsecuritypatchday
- https://me.sap.com/notes/3643865

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-42922) follows observed exploitation activity for CVE-2025-42922. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.