CVE-2025-42993 – SAP S/4HANA Unauthorized Event Consumption and Code Execution Vulnerability

CVE ID : CVE-2025-42993

Published : June 10, 2025, 1:15 a.m. | 1 hour, 44 minutes ago

Description : Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC destination, leading to code execution under the privileges of the assigned high-privilege user. While the vulnerability has a low impact on Availability, it significantly poses a high risk to both Confidentiality and Integrity.

Severity: 6.7 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…