SAP’s June 10, 2025 Security Patch Day delivered critical security updates addressing 14 distinct vulnerabilities across the enterprise software portfolio.
The security notes span severity levels from Critical (CVSS 9.6) to Low (CVSS 3.0), encompassing core platform components, business applications, and integration frameworks.
Organizations are strongly advised to prioritize patch deployment based on vulnerability severity and system exposure to maintain security posture integrity.
The most severe vulnerability addressed in this patch cycle is CVE-2025-42989, affecting SAP NetWeaver Application Server for ABAP with a Critical CVSS score of 9.6.
This missing authorization check vulnerability impacts KERNEL versions 7.89, 7.93, 9.14, and 9.15, potentially allowing unauthorized access to sensitive system functions.
The critical nature of this vulnerability necessitates immediate patching across all affected NetWeaver installations.
High-severity vulnerabilities constitute the largest portion of this month’s security releases, with five distinct issues requiring urgent attention.
CVE-2025-42982 represents an information disclosure vulnerability in SAP GRC (AC Plugin) with a CVSS score of 8.8, affecting GRCPINW versions V1100_700 and V1100_731.
Similarly, CVE-2025-42983 addresses missing authorization checks in SAP Business Warehouse and SAP Plug-In Basis environments, impacting multiple version ranges with a CVSS score of 8.5.
Cross-site scripting vulnerabilities feature prominently in high-severity findings, with CVE-2025-23192 affecting SAP BusinessObjects Business Intelligence BI Workspace (CVSS 8.2) across ENTERPRISE versions 430, 2025, and 2027.
Directory traversal vulnerability CVE-2025-42977 in SAP NetWeaver Visual Composer (VCBASE 7.50) presents additional attack vectors with a CVSS score of 7.6.
The SAP MDM Server faces multiple vulnerabilities under CVE-2025-42994, including related CVEs 2025-42995 and 2025-42996, affecting MDM_SERVER version 710.750 with a collective CVSS score of 7.5.
Medium-severity vulnerabilities predominantly affect SAP S/4HANA applications and integration components, representing five of the fourteen total security notes.
CVE-2025-42993 addresses missing authorization checks in Enterprise Event Enablement functionality within SAP_GWFND versions 757 and 758, carrying a CVSS score of 6.7.
Cross-site scripting Vulnerabilities continue appearing in medium-risk categories, with CVE-2025-31325 affecting SAP NetWeaver ABAP Keyword Documentation in SAP_BASIS version 758 (CVSS 5.8).
Financial application modules face authorization bypass issues, including CVE-2025-42984 in the Manage Central Purchase Contract application across S4CORE versions 106, 107, and 108 (CVSS 5.4).
Integration framework security receives attention through CVE-2025-42998, addressing security misconfiguration vulnerabilities in SAP Business One Integration Framework affecting B1_ON_HANA and SAP-M-BO version 10.0 with a CVSS score of 5.3.
Banking-related S/4HANA applications face authorization control deficiencies in both CVE-2025-42987 (Manage Processing Rules for Bank Statement) and CVE-2025-42991 (Bank Account Application), both carrying CVSS scores of 4.3.
Low-severity vulnerabilities round out the security note portfolio with CVE-2025-42988 addressing server-side request forgery in SAP Business Objects Business Intelligence Platform (CVSS 3.7) and CVE-2025-42990 targeting HTML injection in unprotected SAPUI5 applications (CVSS 3.0).
Despite lower severity ratings, these vulnerabilities contribute to comprehensive attack surface reduction.
According to Report, SAP emphasizes the critical importance of secure configuration practices alongside patch deployment.
Organizations should prioritize Critical and High-severity patches for immediate deployment, followed by systematic Medium and Low-severity updates during scheduled maintenance windows.
The diverse product portfolio affected underscores the need for comprehensive vulnerability management across all SAP landscape components.
Security research community contributions continue enhancing SAP product security, with detailed researcher acknowledgments available through SAP’s official channels.
Organizations must maintain proactive security postures through regular patch application, configuration hardening, and continuous monitoring to ensure optimal protection against evolving threat landscapes.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…