SAP© Security Advisories - 2025 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 110 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 110

System Types

Affected SAP© system types

_{Related note}
3600840

_CVSS
9.6

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42989] Missing Authorization check in SAP NetWeaver Application Server for ABAP

Security Advisory

_{Related note}
3604119

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2025-06

_{Released
on}
2025/05/13

Description
[CVE-2025-42999] Insecure Deserialization in SAP NetWeaver (Visual Composer development server)

Security Advisory

_{Related note}
3609271

_CVSS
8.8

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42982] Information Disclosure in SAP GRC (AC Plugin)

Security Advisory

_{Related note}
3474398

_CVSS
8.7

_{Affected system
type}
BI/BO platform

_Patchday
2025-06

_{Released
on}
2025/01/14

Description
[CVE-2025-0061] Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform

Security Advisory

_{Related note}
3606484

_CVSS
8.5

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42983] Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis

Security Advisory

_{Related note}
3560693

_CVSS
8.2

_{Affected system
type}
BI/BO platform

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-23192] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)

Security Advisory

_{Related note}
3591978

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/05/13

Description
[CVE-2025-43011] Missing Authorization Check in SAP Landscape Transformation (PCL Basis)

Security Advisory

_{Related note}
3610591

_CVSS
7.6

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42977] Directory Traversal vulnerability in SAP NetWeaver Visual Composer

Security Advisory

_{Related note}
3610006

_CVSS
7.5

_{Affected system
type}
SAP MDM Server

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42994] Multiple vulnerabilities in SAP MDM Server

Security Advisory

_{Related note}
3580384

_CVSS
6.7

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42993] Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)

Security Advisory

_{Related note}
3590887

_CVSS
5.8

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-31325] Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation)

Security Advisory

_{Related note}
3585992

_CVSS
5.8

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/05/13

Description
[CVE-2025-43008] Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal

Security Advisory

_{Related note}
3441087

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42984] Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application)

Security Advisory

_{Related note}
3594258

_CVSS
5.3

_{Affected system
type}
SAP Business One

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42998] Security misconfiguration vulnerability in SAP Business One Integration Framework

Security Advisory

_{Related note}
3596850

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42987] Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement)

Security Advisory

_{Related note}
3608058

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42991] Missing Authorization check in SAP S/4HANA (Bank Account Application)

Security Advisory

_{Related note}
3585545

_CVSS
3.7

_{Affected system
type}
BI/BO platform

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42988] Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform

Security Advisory

_{Related note}
3426825

_CVSS
3.1

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/02/11

Description
[CVE-2025-23191] Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP

Security Advisory

_{Related note}
3601169

_CVSS
3.0

_{Affected system
type}
SAP UI5

_Patchday
2025-06

_{Released
on}
2025/06/10

Description
[CVE-2025-42990] HTML Injection in Unprotected SAPUI5 applications

Security Advisory

_{Related note}
3594142

_CVSS
10.0

_{Affected system
type}
Java

Exploit available

_Patchday
2025-05

_{Released
on}
2025/04/24

Description
[CVE-2025-31324] Missing Authorization check in SAP NetWeaver (Visual Composer development server)

Security Advisory

_{Related note}
3581961

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/08

Description
[CVE-2025-27429] Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

Security Advisory

_{Related note}
3587115

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/08

Description
[CVE-2025-31330] Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)

Security Advisory

_{Related note}
3578900

_CVSS
8.6

_{Affected system
type}
Java

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-30018] Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

Security Advisory

_{Related note}
3600859

_CVSS
8.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43010] Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

Security Advisory

_{Related note}
3586013

_CVSS
7.9

_{Affected system
type}
BI/BO platform

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43000] Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)

Security Advisory

_{Related note}
3483344

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2024/07/09

Description
[CVE-2024-39592] Missing Authorization check in SAP PDCE

Security Advisory

_{Related note}
3577300

_CVSS
6.6

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-42997] Information Disclosure vulnerability in SAP Gateway Client

Security Advisory

_{Related note}
3596033

_CVSS
6.4

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43003] Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)

Security Advisory

_{Related note}
2491817

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43009] Missing Authorization check in SAP Service Parts Management (SPM)

Security Advisory

_{Related note}
2719724

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43007] Missing Authorization check in SAP Service Parts Management (SPM)

Security Advisory

_{Related note}
3577287

_CVSS
6.2

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-31329] Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

Security Advisory

_{Related note}
3588455

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43006] Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)

Security Advisory

_{Related note}
3571096

_CVSS
5.3

_{Affected system
type}
SAP Digital...

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43004] Security Misconfiguration Vulnerability in SAP Digital Manufacturing (Production Operator Dashboard)

Security Advisory

_{Related note}
3446649

_CVSS
4.6

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/22

Description
[CVE-2025-31328] Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)

Security Advisory

_{Related note}
3558755

_CVSS
4.4

_{Affected system
type}
SAP Data Services

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-26662] Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console

Security Advisory

_{Related note}
3359825

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/22

Description
[CVE-2025-31327] OData meta-data property entity tampering in SAP Field Logistics

Security Advisory

_{Related note}
3227940

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43002] Missing Authorization check in SAP S4/HANA (OData meta-data property)

Security Advisory

_{Related note}
3574520

_CVSS
4.3

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43005] Information Disclosure vulnerability in SAP GUI for Windows

Security Advisory

_{Related note}
3572688

_CVSS
9.8

_{Affected system
type}
SAP Financial Consolidation

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-30016] Authentication Bypass Vulnerability in SAP Financial Consolidation

Security Advisory

_{Related note}
3525794

_CVSS
8.8

_{Affected system
type}
BI/BO platform

_Patchday
2025-04

_{Released
on}
2025/02/11

Description
[CVE-2025-0064] Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)

Security Advisory

_{Related note}
3554667

_CVSS
8.5

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-23186] Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

Security Advisory

_{Related note}
3590984

_CVSS
8.1

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2024-56337] Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat within SAP Commerce Cloud

Security Advisory

_{Related note}
3581811

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-27428] Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)

Security Advisory

_{Related note}
2927164

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-30014] Directory Traversal vulnerability in SAP Capital Yield Tax Management

Security Advisory

_{Related note}
3543274

_CVSS
6.8

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-26654] Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)

Security Advisory

_{Related note}
3571093

_CVSS
6.7

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-30013] Code Injection vulnerability in SAP ERP BW Business Content

Security Advisory

_{Related note}
3565751

_CVSS
6.6

_{Affected system
type}
BI/BO platform

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-31332] Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform

Security Advisory

_{Related note}
3568307

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-26657] Information Disclosure vulnerability in SAP KMC WPC

Security Advisory

_{Related note}
3559307

_CVSS
4.7

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-26653] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

Security Advisory

_{Related note}
3558864

_CVSS
4.4

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-30017] Missing Authorization check in SAP Solution Manager

Security Advisory

_{Related note}
3525971

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2024/10/10

Description
[CVE-2025-31333] Odata meta-data tampering in SAP S4CORE entity

Security Advisory

_{Related note}
3568778

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-27437] Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface)

Security Advisory

_{Related note}
3577131

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-31331] Authorization Bypass vulnerability in SAP NetWeaver

Security Advisory

_{Related note}
3539465

_CVSS
4.2

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-27435] Information Disclosure Vulnerability in SAP Commerce Cloud

Security Advisory

_{Related note}
3565944

_CVSS
4.1

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/04/08

Description
[CVE-2025-30015] Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)

Security Advisory

_{Related note}
3561861

_CVSS
3.5

_{Affected system
type}
ABAP

_Patchday
2025-04

_{Released
on}
2025/03/11

Description
[CVE-2025-27430] Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center)

Security Advisory

_{Related note}
3569602

_CVSS
8.8

_{Affected system
type}
SAP Commerce

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-27434] Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)

Security Advisory

_{Related note}
3563927

_CVSS
8.8

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-26661] Missing Authorization check in SAP NetWeaver (ABAP Class Builder)

Security Advisory

_{Related note}
3566851

_CVSS
8.6

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2024-38286] Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud

Security Advisory

_{Related note}
3567974

_CVSS
8.1

_{Affected system
type}
SAP Approuter

_Patchday
2025-03

_{Released
on}
2025/02/11

Description
[CVE-2025-24876] Authentication bypass via authorization code injection in SAP Approuter

Security Advisory

_{Related note}
3561045

_CVSS
6.8

_{Affected system
type}
SAP Business One

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-26658] Broken Authentication in SAP Business One (Service Layer)

Security Advisory

_{Related note}
3552824

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-26659] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

Security Advisory

_{Related note}
3562390

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-25242] Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP

Security Advisory

_{Related note}
3552144

_CVSS
5.7

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-25244] Missing Authorization Check in SAP Business Warehouse (Process Chains)

Security Advisory

_{Related note}
3567246

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-27431] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

Security Advisory

_{Related note}
3557469

_CVSS
5.4

_{Affected system
type}
BI/BO platform

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-25245] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

Security Advisory

_{Related note}
3561792

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-23194] Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component)

Security Advisory

_{Related note}
3558132

_CVSS
4.9

_{Affected system
type}
Kernel

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-0071] Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager

Security Advisory

_{Related note}
3557459

_CVSS
4.7

_{Affected system
type}
BI/BO platform

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-0062] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

Security Advisory

_{Related note}
3557655

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-26660] Broken Access Control in SAP Fiori apps (Posting Library)

Security Advisory

_{Related note}
3475427

_CVSS
4.3

_{Affected system
type}
SAP Fiori

_Patchday
2025-03

_{Released
on}
2024/08/13

Description
[CVE-2024-41736] Information Disclosure vulnerability in SAP Permit to Work

Security Advisory

_{Related note}
3474392

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-26656] Missing Authorization check in S/4HANA (Manage Purchasing Info Records)

Security Advisory

_{Related note}
3557131

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-23188] Missing Authorization check in SAP S/4HANA (RBD)

Security Advisory

_{Related note}
3565835

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-27433] Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements)

Security Advisory

_{Related note}
3549494

_CVSS
4.1

_{Affected system
type}
BI/BO platform

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-23185] Information Disclosure in SAP Business Objects Business Intelligence Platform

Security Advisory

_{Related note}
3562415

_CVSS
3.7

_{Affected system
type}
SAP Commerce Cloud SAP DataHub

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2024-38819] Multiple vulnerabilities in Spring Framework within SAP Commerce Cloud and SAP Datahub

Security Advisory

_{Related note}
3347991

_CVSS
3.1

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/02/24

Description
[CVE-2025-26655] Missing Authorization check in SAP JIT(Outbound)

Security Advisory

_{Related note}
3568865

_CVSS
2.4

_{Affected system
type}
ABAP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
[CVE-2025-27432] Missing Authorization check in SAP Electronic Invoicing for Brazil (eDocument Cockpit)

Security Advisory

_{Related note}
3576540

_CVSS
0.0

_{Affected system
type}
BTP

_Patchday
2025-03

_{Released
on}
2025/03/11

Description
Open Source Security Advisory: Best Practices for Securing Spring Boot Actuator Endpoints for applications running on BTP

Security Advisory

_{Related note}
3417627

_CVSS
8.8

_{Affected system
type}
Java

_Patchday
2025-02

_{Released
on}
2024/02/13

Description
[CVE-2024-22126] Cross Site Scripting vulnerability in NetWeaver AS Java (User Admin Application)

Security Advisory

_{Related note}
3567551

_CVSS
8.6

_{Affected system
type}
Java

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-25243] Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)

Security Advisory

_{Related note}
3567172

_CVSS
7.5

_{Affected system
type}
SAP Enterprise...

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2024-38819] Multiple vulnerabilities in SAP Enterprise Project Connection

Security Advisory

_{Related note}
3563929

_CVSS
7.1

_{Affected system
type}
SAP HANA Platform

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-24868] Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services)

Security Advisory

_{Related note}
3559510

_CVSS
6.8

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-24874] Missing Defense in Depth Against Clickjacking in SAP Commerce (Backoffice)

Security Advisory

_{Related note}
3555364

_CVSS
6.8

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-24875] SameSite Defense in Depth not applied for some cookies in SAP Commerce

Security Advisory

_{Related note}
3445708

_CVSS
6.1

_{Affected system
type}
BI/BO platform

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-24867] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad)

Security Advisory

_{Related note}
3557138

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
Update 1 to Security Note 3417627 - [CVE-2024-22126] Cross Site Scripting vulnerability in NetWeaver AS Java (User Admin Application)

Security Advisory

_{Related note}
3562336

_CVSS
6.0

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-24870] Insecure Key & Secret Management vulnerability in SAP GUI for Windows

Security Advisory

_{Related note}
3540273

_CVSS
5.5

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2024-45216] Multiple vulnerabilities in Apache Solr within SAP Commerce Cloud

Security Advisory

_{Related note}
3532025

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-25241] Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests)

Security Advisory

_{Related note}
3526203

_CVSS
5.4

_{Affected system
type}
Java

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-0054] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

Security Advisory

_{Related note}
3546470

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-23187] Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)

Security Advisory

_{Related note}
3561264

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-23193] Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP

Security Advisory

_{Related note}
3287784

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2025-02

_{Released
on}
2023/04/11

Description
[CVE-2023-24527] Improper Access Control in SAP NetWeaver AS Java for Deploy Service

Security Advisory

_{Related note}
3550027

_CVSS
4.3

_{Affected system
type}
Java

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-24869] Information Disclosure vulnerability in SAP NetWeaver Application Server Java

Security Advisory

_{Related note}
3547581

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-23190] Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)

Security Advisory

_{Related note}
3553753

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-02

_{Released
on}
2025/02/11

Description
[CVE-2025-24872] Missing Authorization check in SAP ABAP Platform (ABAP Build Framework)

Security Advisory

_{Related note}
3550708

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0066] Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform(Internet Communication Framework)

Security Advisory

_{Related note}
3537476

_CVSS
9.9

_{Affected system
type}
Kernel

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0070] Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform

Security Advisory

_{Related note}
3550816

_CVSS
8.8

_{Affected system
type}
ABAP

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0063] SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3542533

_CVSS
7.8

_{Affected system
type}
SAPSetup

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0069] DLL Hijacking vulnerability in SAPSetup

Security Advisory

_{Related note}
3542698

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0058] Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow

Security Advisory

_{Related note}
3540108

_CVSS
6.3

_{Affected system
type}
Java

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0067] Missing Authorization check in SAP NetWeaver Application Server Java

Security Advisory

_{Related note}
3502459

_CVSS
6.0

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0056] Information Disclosure vulnerability in SAP GUI for Java

Security Advisory

_{Related note}
3472837

_CVSS
6.0

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0055] Information Disclosure vulnerability in SAP GUI for Windows

Security Advisory

_{Related note}
3503138

_CVSS
6.0

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0059] Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

Security Advisory

_{Related note}
3536461

_CVSS
5.3

_{Affected system
type}
ABAP

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0053] Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Security Advisory

_{Related note}
3514421

_CVSS
4.8

_{Affected system
type}
Java

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0057] Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application)

Security Advisory

_{Related note}
3550674

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
[CVE-2025-0068] Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

Security Advisory

_{Related note}
3492169

_CVSS
2.2

_{Affected system
type}
BI/BO platform

_Patchday
2025-01

_{Released
on}
2025/01/14

Description
Multiple Buffer overflow vulnerabilities in SAP BusinessObjects Business Intelligence Platform (Crystal Reports for Enterprise)

Security Advisory

Notifications

Severity

SAP© Security advisories 110

System Types

Affected SAP© system types

Related note 3600840

CVSS 9.6

Affected system type ABAP

Patchday2025-06

Released on2025/06/10

Related note 3604119

CVSS 9.1

Affected system type Java

Patchday2025-06

Released on2025/05/13

Related note 3609271

CVSS 8.8

Affected system type ABAP

Patchday2025-06

Released on2025/06/10

Related note 3474398

CVSS 8.7

Affected system type BI/BO platform

Patchday2025-06

Released on2025/01/14

Related note 3606484

CVSS 8.5

Affected system type ABAP

Patchday2025-06

Released on2025/06/10

Related note 3560693

CVSS 8.2

Affected system type BI/BO platform

Patchday2025-06

Released on2025/06/10

Related note 3591978

CVSS 7.7

Affected system type ABAP

Patchday2025-06

Released on2025/05/13

Related note 3610591

CVSS 7.6

Affected system type ABAP

Patchday2025-06

Released on2025/06/10

Related note 3610006

CVSS 7.5

Affected system type SAP MDM Server

Patchday2025-06

Released on2025/06/10

Related note 3580384

CVSS 6.7

Affected system type ABAP

Patchday2025-06

Released on2025/06/10

Related note 3590887

CVSS 5.8

Affected system type ABAP

Patchday2025-06

Released on2025/06/10

Related note 3585992

CVSS 5.8

Affected system type ABAP

Patchday2025-06

Released on2025/05/13

Related note 3441087

CVSS 5.4

Affected system type ABAP

Patchday2025-06

Released on2025/06/10

Related note 3594258

CVSS 5.3

Affected system type SAP Business One

Patchday2025-06

Released on2025/06/10

Related note 3596850

CVSS 4.3

Affected system type ABAP

Patchday2025-06

Released on2025/06/10

_{Related note}
3600840

_CVSS
9.6

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3604119

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2025-06

_{Released
on}
2025/05/13

_{Related note}
3609271

_CVSS
8.8

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3474398

_CVSS
8.7

_{Affected system
type}
BI/BO platform

_Patchday
2025-06

_{Released
on}
2025/01/14

_{Related note}
3606484

_CVSS
8.5

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3560693

_CVSS
8.2

_{Affected system
type}
BI/BO platform

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3591978

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/05/13

_{Related note}
3610591

_CVSS
7.6

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3610006

_CVSS
7.5

_{Affected system
type}
SAP MDM Server

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3580384

_CVSS
6.7

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3590887

_CVSS
5.8

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3585992

_CVSS
5.8

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/05/13

_{Related note}
3441087

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3594258

_CVSS
5.3

_{Affected system
type}
SAP Business One

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3596850

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10

_{Related note}
3608058

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-06

_{Released
on}
2025/06/10