SAP NetWeaver RMI-P4 Deserialization Vulnerability

CRITICAL (10.0)
cwe-502deserialization-vulnerabilityjavanetweaverremote-exploitationrmi-p4sap

Threat Intelligence

⚠️ CRITICAL GAP - Exploits exist but no detection available
EPSS Score: 0.02% chance of exploitation (percentile: 5%)
🔍 Detection Tools: None available in major open-source tools
⚔️ Exploit Availability: GitHub PoC

How we test →

What is it?

SAP NetWeaver is a Java-based enterprise software used for developing and integrating various business applications. The RMI-P4 module allows remote method invocation, but due to a deserialization vulnerability, an attacker can exploit the system by submitting malicious payload to an open port, leading to arbitrary OS command execution.

Am I affected?

You're affected if you use Due to a deserialization vulnerability. Specific version info not stated in the advisory.

How to fix

  1. Upgrade to SAP NetWeaver 7.5 SP3 or later.
  2. Immediate mitigations:
  3. Restrict network access to your SAP NetWeaver instance (firewall it from the public internet)
  4. Audit admin account activity for suspicious access patterns
  5. Monitor for unauthorized token creation

References