SAP’s Security Patch Day on September 9, 2025, introduced fixes for 21 newly discovered vulnerabilities across its product portfolio and provided updates to four previously released security notes.
With four issues rated as Critical, organizations running SAP environments are urged to prioritize patching to safeguard their systems from potential exploits.
This month’s release spans a variety of SAP products, from NetWeaver components and ABAP platforms to S/4HANA and Business One modules.
Four of the newly addressed vulnerabilities carry a CVSS score of 9.0 or higher, reflecting the severity and potential impact on confidentiality, integrity, and availability if left unpatched.
Additionally, SAP issued updates for four earlier security notes to refine or expand existing patches.
SAP strongly recommends that customers visit the Support Portal and apply the relevant security notes immediately.
Following secure configuration guidance is also essential to maintain a robust security posture.
The Critical issues include insecure deserialization in SAP NetWeaver, insecure file operations in AS Java, directory traversal in ABAP platforms, and missing authentication checks in NetWeaver kernels.
High-severity flaws mostly involve missing input validation or insecure storage, affecting modules like Business One, S/4HANA replication, and SAP Landscape Transformation servers.
Medium-rated vulnerabilities cover misconfigurations, cross-site scripting, and missing authorization checks in HCM Fiori apps, Commerce Cloud, and Business Planning modules.
Two Low-rated flaws address reverse tabnabbing in Fiori launchpads and outdated OpenSSL in Adobe Document Services, alongside a historical vulnerability in Commerce Cloud.
Below is a consolidated table listing each security note, associated CVE identifier(s), product, version, priority, and CVSS score.
| CVE(s) | Title | Priority | CVSS |
| CVE-2025-42944 | Insecure Deserialization | Critical | 10.0 |
| CVE-2025-42922 | Insecure File Operations | Critical | 9.9 |
| CVE-2023-27500 | Directory Traversal | Critical | 9.6 |
| CVE-2025-42958 | Missing Authentication check | Critical | 9.1 |
| CVE-2025-42933 | Insecure Storage of Sensitive Information | High | 8.8 |
| CVE-2025-42929 | Missing input validation | High | 8.1 |
| CVE-2025-42916 | Missing input validation | High | 8.1 |
| CVE-2025-27428 | Directory Traversal | High | 7.7 |
| CVE-2025-22228 | Security Misconfiguration | Medium | 6.6 |
| CVE-2025-42930 | Denial of Service | Medium | 6.5 |
| CVE-2025-42912, 42913, 42914 | Missing Authorization check | Medium | 6.5 |
| CVE-2025-42917 | Missing Authorization check | Medium | 6.5 |
| CVE-2023-5072 | Denial of Service (outdated JSON library) | Medium | 6.5 |
| CVE-2025-42920 | Cross-Site Scripting | Medium | 6.1 |
| CVE-2025-42938 | Cross-Site Scripting | Medium | 6.1 |
| CVE-2025-42915 | Missing Authorization Check | Medium | 5.4 |
| CVE-2025-42926 | Missing Authentication check | Medium | 5.3 |
| CVE-2025-42911 | Missing Authorization check | Medium | 5.0 |
| CVE-2025-42961 | Missing Authorization check | Medium | 4.9 |
| CVE-2025-42925 | Predictable Object Identifier | Medium | 4.3 |
| CVE-2025-42923 | Cross-Site Request Forgery | Medium | 4.3 |
| CVE-2025-42918 | Missing Authorization check | Medium | 4.3 |
| CVE-2025-42941 | Reverse Tabnabbing | Low | 3.5 |
| CVE-2025-42927 | Information Disclosure (Outdated OpenSSL) | Low | 3.4 |
| CVE-2024-13009 | Improper Resource Release | Low | 3.1 |
Secure configuration guidance and credits for researchers are available on the SAP Support portal.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…