External risk intelligence

SAP NetWeaver RMI-P4 Deserialization Vulnerability Allows OS Command Execution

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-42944

The vulnerability exists in the SAP NetWeaver RMI-P4 module. While not always exposed to the public internet by design, SAP NetWeaver is frequently deployed as an enterprise application server or integration gateway where such communication ports are intentionally reachable across network boundaries or external interfaces to facilitate remote service calls, making internet-facing exposure a common deployment scenario.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SAP NetWeaver's RMI-P4 module, allowing unauthenticated attackers to execute arbitrary commands on the operating system by submitting malicious data. This could significantly impact the confidentiality, integrity, and availability of affected systems.

Unauthenticated attackers can run commands on SAP systems.
Impacts confidentiality, integrity, and availability.
Confirm relevance and assess exposure to SAP NetWeaver.

Attack Path

How an attacker could exploit the issue

An attacker can reach an SAP NetWeaver system through its RMI-P4 module without needing any credentials. By sending a specially crafted data package to an exposed port, the attacker can trigger a deserialization flaw. This flaw allows the system to process malicious Java objects, ultimately enabling the attacker to run commands on the server's operating system.

No authentication needed.
Submit malicious payload to open port.
Arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in SAP NetWeaver's RMI-P4 module could allow an unauthenticated attacker to execute arbitrary commands on the operating system. This could affect the confidentiality, integrity, and availability of the application's services and data when exposed to an open port.

System commands and application data at risk.
Malicious Java objects sent via RMI-P4.
Compromise of service and data integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

SAP NetWeaver application owners and infrastructure teams are primarily responsible for addressing this critical deserialization vulnerability. The first practical step involves identifying all instances of SAP NetWeaver, determining their network exposure and business criticality, and then engaging with the accountable owner to plan remediation.

Application and infrastructure teams own remediation.
Verify RMI-P4 module exposure and business impact.
Coordinate vendor notes and plan system updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SAP NetWeaver and the RMI-P4 module?

SAP NetWeaver is a comprehensive platform used by enterprises to build and integrate business applications. The RMI-P4 module acts as a communication component within this platform, enabling remote Java objects to be called and processed. It essentially facilitates the exchange of data and commands between different parts of a distributed enterprise system.

What is the deserialization vulnerability in CVE-2025-42944?

This is a CWE-502 weakness. It occurs when a program takes data received from an external source and reconstructs it into a complex Java object without sufficient validation. An attacker can craft a malicious object that, when processed, tricks the system into executing unauthorized commands on the underlying operating system.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted data package to an open RMI-P4 port. No login or credentials are required to initiate the attack. However, simply having the software installed does not trigger the bug; the attacker must have network-level access to the specific RMI-P4 port to deliver the malicious payload.

Is my SAP NetWeaver instance at risk?

According to Halo Surface Signal, risk depends on network placement. While RMI-P4 is not always public by design, SAP NetWeaver is often deployed as a gateway where these ports are reachable across network boundaries. If your instance is internet-facing or accessible to untrusted network segments, it is at higher risk of exploitation.

What should I do first to address this vulnerability?

Start by identifying all SAP NetWeaver instances within your environment. Once mapped, verify the network configuration for each to see if the RMI-P4 module is reachable from outside your trusted network. Finally, coordinate with your infrastructure team to review official SAP security notes for patch requirements.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.