{"id":14762,"date":"2025-09-10T00:14:58","date_gmt":"2025-09-10T00:14:58","guid":{"rendered":"https:\/\/newestek.com\/?p=14762"},"modified":"2025-09-10T00:14:58","modified_gmt":"2025-09-10T00:14:58","slug":"patch-tuesday-priorities-vulnerabilities-in-sap-netweaver-and-microsoft-ntlm-and-hyper-v","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=14762","title":{"rendered":"Patch Tuesday priorities: Vulnerabilities in SAP NetWeaver and Microsoft NTLM and Hyper-V"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

CISOs with SAP NetWeaver AS Java servers in their environments should make sure admins patch two highly critical vulnerabilities as soon as possible.<\/p>\n

They are among the most important of the monthly Patch Tuesday fixes issued today by a number of vendors.<\/p>\n

The worst NetWeaver vulnerability, CVE-2025-42944<\/a>, rated 10 on the CVSS scale, is an insecure deserialization vulnerability in the RMI-P4 module of an AS Java deployment.<\/p>\n

\u201cThe vulnerability allows an unauthenticated attacker to execute arbitrary OS commands by submitting a malicious payload to an open port,\u201d noted security researchers at Onapsis. \u201cA successful exploit can lead to full compromise of the application,\u201d they said in a blog<\/a>.<\/p>\n

As a temporary workaround until the patch can be installed, admins should add P4 port filtering at the ICM level to prevent unknown hosts from connecting to the P4 port.<\/p>\n

This vulnerability could be exploited using a similar attack to the one\u00a0published a few weeks ago<\/a>\u00a0by a suspected merged group of threat actors that researchers call Scattered LAPSUS$ ShinyHunters, Onapsis CTO Juan Pablo Perez-Etchegoyen<\/a> told\u00a0CSO<\/em>. \u201cThe sole fact of being it a deserialization vulnerability, exploitable in an unauthenticated way, makes it very critical,\u201d he said. \u201cThe positive side of this vulnerability for defenders is that it is exploitable through a protocol that is not typically internet-facing, the RMI-P4 SAP protocol.\u201d\u00a0<\/p>\n

Deserialization vulnerabilities are common in products like NetWeaver, Johannes Ullrich<\/a>, the SANS Institute\u2019s dean of research, told CSO. For example, he said, Oracle WebLogic, NetWeaver\u2019s direct competitor, has been affected by numerous similar vulnerabilities.<\/p>\n

The second worst NetWeaver AS Java hole, with a CVSS score of 9.9, is an insecure file operations vulnerability. This service flaw allows an attacker, authenticated as a non-administrative user, to upload arbitrary files. On execution of the file, the system can be fully compromised. Perez-Etchegoyen noted that this vulnerability can be exploited over HTTP, which he said makes it very critical. However, it requires an authenticated user to exploit it, adding an extra hurdle for attackers.<\/p>\n

Also needing patching is a missing authentication check in NetWeaver applications running on IBM i-series to close a vulnerability allowing high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. The hole is rated 9.1 on the CVSS scale.<\/p>\n

Perez-Etchegoyen recommends CISOs have their staff act as quickly as possible on today\u2019s most critical fixes, the ones tagged CVSS 9.9 and 10.<\/p>\n

However, he added, the eight HotNews and High Priority Notes are also important, and should be triaged, analyzed and ideally addressed as soon as possible.<\/p>\n

Microsoft patches<\/h2>\n

Meanwhile Microsoft released fixes for 13 critical vulnerabilities, including a zero day, as part of its September Patch Tuesday effort.<\/p>\n

For the third time this year, Microsoft patched more elevation of privilege vulnerabilities than remote code execution flaws, noted Satnam Narang<\/a>, senior staff research engineer at Tenable, pointing out that nearly half of all bugs this month are privilege escalation vulnerabilities. Many of this type of flaw addressed each Patch Tuesday requires an attacker to have gained access to a target system first (post-compromise) before attempting to elevate privileges, Narang added.<\/p>\n

Controversy over SMB fix<\/h2>\n

One of the zero day vulnerabilities patched this month is CVE-2025-55234<\/a>, a privilege escalation flaw in Windows Server Message Block (SMB) that has already been publicly disclosed. In some configurations, the flaw could make SMB Server susceptible to relay attacks, Microsoft said. This patch appears to have been released to help customers audit and assess their environment and identify incompatibility issues prior to utilizing some of the hardening capabilities for SMB Servers, Narang said.<\/p>\n

This patch is an example of some September patches that require additional activities beyond deployment, commented Mike Walters, president of Action1. Organizations must first deploy the updates to enable auditing, then assess compatibility before taking SMB Server hardening measures, which include signing and implementing Extended Protection for Authentication. CISOs should plan a phased approach to the hardening, covering assessment, testing, and implementation, to avoid business disruption, Walters advised.<\/p>\n

However, Tyler Reguly<\/a>, associate director of R&D at Fortra, said, \u201c[this listing] made me do a double take\u201d and should have been rejected by CVE authorities. \u201cWe know that relay attacks are possible against SMB and we know that there are hardening mechanisms available to assist with this. So, why is Microsoft releasing a CVE where they state<\/a>, \u201cMicrosoft is releasing this CVE to provide customers with audit capabilities to help them to assess their environment and to identify any potential device or software incompatibility issues before deploying SMB Server hardening measures that protect against relay attacks?\u201d<\/p>\n

\u201cAs far as I\u2019m concerned,\u201d he said, \u201cMicrosoft told us they have assigned a CVE not because of a vulnerability, but to raise awareness to new auditing capabilities that they\u2019ve added to assist with protective measures. If that is the case, that is a misuse of the CVE system. If that is not the case, then Microsoft needs to provide clarification very quickly.\u201d<\/p>\n

CISOs should ask Microsoft if there truly is a vulnerability associated with this CVE, he said. \u201cIf this is a vendor using a CVE simply to add a feature, that is something that CSOs everywhere need to push back against,\u201d he said. \u201cThere are enough legitimate CVEs being issued that we shouldn\u2019t have to worry about CVEs without new vulnerabilities. This just adds complexity to an already complex situation.\u201d<\/p>\n

Vulnerabilities in Hyper-V<\/h2>\n

Windows admins should also pay attention to quickly fixing two vulnerabilities (CVE-2025-54098<\/a> and CVE-2025-55224<\/a>) in the Windows Hyper-V hypervisor. Improper access control in Hyper-V can allow an authorized attacker to elevate privileges locally, Microsoft said.<\/p>\n

These holes demand close attention from CISOs managing enterprise data centers, according Walters of Action1. \u201cThese guest-to-host escape flaws could put entire virtualization hosts running critical workloads at risk,\u201d he said. \u201cSecurity leaders should work closely with data center and virtualization teams to apply these patches quickly in production environments.\u201d<\/p>\n

Another priority for enterprise security leaders that Walters drew attention to is\u00a0CVE-2025-54918<\/a>, a Windows NTLM Elevation of Privilege vulnerability. NTLM is a suite of protocols for user authorization. With an 8.8 CVSS score, the flaw affects centrally managed authentication infrastructure and could let attackers gain SYSTEM-level privileges across networks, he said. Microsoft has rated it as \u2018Exploitation More Likely,\u2019 he pointed out, signaling higher urgency than other similar vulnerabilities less likely for exploit. \u201cSecurity teams should patch domain controllers and authentication servers promptly, potentially accelerating normal patch cycles for these critical systems,\u201d he said.<\/p>\n

Since 2022 Microsoft has patched a number of NTFS file system vulnerabilities in Windows, Tenable\u2019s Narang said, with the majority of these flaws resulting in information disclosure or privilege escalation. However, this month Microsoft patched its second remote code execution vulnerability in NTFS in 2025. The first, CVE-2025-24993, was patched in March and was exploited in the wild as a zero-day. While this one does not appear to have been exploited, it is still certainly worth keeping an eye on, since NTFS is the primary file system used by Windows, Narang said.<\/p>\n

Vulnerability in HPC Pack<\/h2>\n

Fortra\u2019s Reguly flagged a critical vulnerability in the Microsoft High Performance Compute (HPC) Pack (CVE-2025-55232<\/a> ) that could allow unauthorized attackers to execute code over the network. \u201cThat makes this a CVSS 9.8 vulnerability and one that people need to pay attention to,\u201d he said. Microsoft has provided mitigation steps for those who cannot update immediately. This is important, Reguly said, as the update for HPC Pack 2016 is to migrate to HPC Pack 2019; there is no fix for HPC Pack 2016. \u201cThankfully, Microsoft has labelled this as exploitation less likely, with a severity of important,\u201d he said, \u201cbut it is still something that you\u2019ll want to pay attention to if you have the High Performance Compute Pack deployed in your environment.\u201d<\/p>\n

Kevin Breen<\/a>, senior director of threat research at Immersive, noted that while no Microsoft vulnerabilities this month are marked as being actively exploited in the wild, \u201cthat doesn\u2019t mean security\u00a0teams can sit back and rest on their laurels. There are still a number of potentially high-impact vulnerabilities that should be patched quickly. Threat actors are known to try to quickly reverse engineer security patches to create working exploits before organizations have a chance to fully roll out patches; these are commonly referred to as n-day vulnerabilities.\u201d<\/p>\n

He feels the previously mentioned Windows NTLM vulnerability (CVE-2025-54918) should be high on the list of patches to apply, because its marked by Microsoft as \u2018Exploitation More Likely.\u2019<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

CISOs with SAP NetWeaver AS Java servers in their environments should make sure admins patch two highly critical vulnerabilities as soon as possible. They are among the most important of the monthly Patch Tuesday fixes issued today by a number of vendors. The worst NetWeaver vulnerability, CVE-2025-42944, rated 10 on the CVSS scale, is an insecure deserialization vulnerability in the RMI-P4 module of an AS… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-14762","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/14762","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14762"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/14762\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14762"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14762"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14762"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}