Vulnerability · Published Dec 9, 2025 · Assigned by sap
CVE-2025-42928Deserialization Vulnerability in SAP jConnect - SDK for ASE
Critical 9.1
In plain English
A critical-severity unsafe deserialization in SAP jConnect - SDK for ASE from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.5% (higher than 95% of all known vulnerabilities).
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)9.5%top 4.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high impact on confidentiality, integrity and availability of the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP jConnect - SDK for ASE | SYBASE_SOFTWARE_DEVELOPER_KIT 16.0.416.1 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H