SAP© Security Advisories - 05 2025 - SecurityBridge Cloud Platform

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 20 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 20

System Types

Affected SAP© system types

_{Related note}
3581961

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/08

Description
[CVE-2025-27429] Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

Security Advisory

_{Related note}
3359825

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/22

Description
[CVE-2025-31327] OData meta-data property entity tampering in SAP Field Logistics

Security Advisory

_{Related note}
3558755

_CVSS
4.4

_{Affected system
type}
SAP Data Services

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-26662] Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console

Security Advisory

_{Related note}
2491817

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43009] Missing Authorization check in SAP Service Parts Management (SPM)

Security Advisory

_{Related note}
3574520

_CVSS
4.3

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43005] Information Disclosure vulnerability in SAP GUI for Windows

Security Advisory

_{Related note}
3577300

_CVSS
6.6

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-42997] Information Disclosure vulnerability in SAP Gateway Client

Security Advisory

_{Related note}
3578900

_CVSS
8.6

_{Affected system
type}
Java

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-30018] Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

Security Advisory

_{Related note}
3596033

_CVSS
6.4

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43003] Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)

Security Advisory

_{Related note}
3227940

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43002] Missing Authorization check in SAP S4/HANA (OData meta-data property)

Security Advisory

_{Related note}
2719724

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43007] Missing Authorization check in SAP Service Parts Management (SPM)

Security Advisory

_{Related note}
3586013

_CVSS
7.9

_{Affected system
type}
BI/BO platform

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43000] Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)

Security Advisory

_{Related note}
3587115

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/08

Description
[CVE-2025-31330] Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)

Security Advisory

_{Related note}
3446649

_CVSS
4.6

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/22

Description
[CVE-2025-31328] Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)

Security Advisory

_{Related note}
3577287

_CVSS
6.2

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-31329] Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

Security Advisory

_{Related note}
3604119

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-42999] Insecure Deserialization in SAP NetWeaver (Visual Composer development server)

Security Advisory

_{Related note}
3588455

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43006] Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)

Security Advisory

_{Related note}
3571096

_CVSS
5.3

_{Affected system
type}
SAP Digital...

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43004] Security Misconfiguration Vulnerability in SAP Digital Manufacturing (Production Operator Dashboard)

Security Advisory

_{Related note}
3594142

_CVSS
10.0

_{Affected system
type}
Java

Exploit available

_Patchday
2025-05

_{Released
on}
2025/04/24

Description
[CVE-2025-31324] Missing Authorization check in SAP NetWeaver (Visual Composer development server)

Security Advisory

_{Related note}
3483344

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2024/07/09

Description
[CVE-2024-39592] Missing Authorization check in SAP PDCE

Security Advisory

_{Related note}
3600859

_CVSS
8.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

Description
[CVE-2025-43010] Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

Security Advisory

Notifications

Severity

SAP© Security advisories 20

System Types

Affected SAP© system types

Related note 3581961

CVSS 9.9

Affected system type ABAP

Patchday2025-05

Released on2025/04/08

Related note 3359825

CVSS 4.3

Affected system type ABAP

Patchday2025-05

Released on2025/04/22

Related note 3558755

CVSS 4.4

Affected system type SAP Data Services

Patchday2025-05

Released on2025/05/13

Related note 2491817

CVSS 6.3

Affected system type ABAP

Patchday2025-05

Released on2025/05/13

Related note 3574520

CVSS 4.3

Affected system type SAP GUI / Frontend

Patchday2025-05

Released on2025/05/13

Related note 3577300

CVSS 6.6

Affected system type ABAP

Patchday2025-05

Released on2025/05/13

Related note 3578900

CVSS 8.6

Affected system type Java

Patchday2025-05

Released on2025/05/13

Related note 3596033

CVSS 6.4

Affected system type ABAP

Patchday2025-05

Released on2025/05/13

Related note 3227940

CVSS 4.3

Affected system type ABAP

Patchday2025-05

Released on2025/05/13

Related note 2719724

CVSS 6.3

Affected system type ABAP

Patchday2025-05

Released on2025/05/13

Related note 3586013

CVSS 7.9

Affected system type BI/BO platform

Patchday2025-05

Released on2025/05/13

Related note 3587115

CVSS 9.9

Affected system type ABAP

Patchday2025-05

Released on2025/04/08

Related note 3446649

CVSS 4.6

Affected system type ABAP

Patchday2025-05

Released on2025/04/22

Related note 3577287

CVSS 6.2

Affected system type ABAP

Patchday2025-05

Released on2025/05/13

Related note 3604119

CVSS 9.1

Affected system type Java

Patchday2025-05

Released on2025/05/13

_{Related note}
3581961

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/08

_{Related note}
3359825

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/22

_{Related note}
3558755

_CVSS
4.4

_{Affected system
type}
SAP Data Services

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
2491817

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
3574520

_CVSS
4.3

_{Affected system
type}
SAP GUI / Frontend

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
3577300

_CVSS
6.6

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
3578900

_CVSS
8.6

_{Affected system
type}
Java

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
3596033

_CVSS
6.4

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
3227940

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
2719724

_CVSS
6.3

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
3586013

_CVSS
7.9

_{Affected system
type}
BI/BO platform

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
3587115

_CVSS
9.9

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/08

_{Related note}
3446649

_CVSS
4.6

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/04/22

_{Related note}
3577287

_CVSS
6.2

_{Affected system
type}
ABAP

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
3604119

_CVSS
9.1

_{Affected system
type}
Java

_Patchday
2025-05

_{Released
on}
2025/05/13

_{Related note}
3588455

_CVSS
6.1

_{Affected system
type}
Java

_Patchday
2025-05

_{Released
on}
2025/05/13