SAP Security Notes - 09/25 - SecurityBridge Cloud

We've created the first of its kind, SecurityBridge Cloud Platform, designed to prioritize SAP patches, updates, and remediation strategies that help prevent disruptions to critical business systems. Our security advisories provide SAP users with valuable insights into the security and business implications of operating SAP.

The user interface is designed to be as intuitive as possible, but we’d love to hear your feedback and suggestions.
We hope you enjoy using it!

× Yikes, there is work to do!
This time we found critical correction advisiories. We count 25 and the highest CVSS score is 10.0.

Severity

SAP© Security advisories 25

System Types

Affected SAP© system types

_{Related note}
3634501

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42944] Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)

Security Advisory

_{Related note}
3643865

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42922] Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)

Security Advisory

_{Related note}
3302162

_CVSS
9.6

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2023/03/14

Description
[CVE-2023-27500] Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

Security Advisory

_{Related note}
3627373

_CVSS
9.1

_{Affected system
type}
Kernel

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42958] Missing Authentication check in SAP NetWeaver

Security Advisory

_{Related note}
3642961

_CVSS
8.8

_{Affected system
type}
SAP Business One

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42933] Insecure Storage of Sensitive Information in SAP Business One (SLD)

Security Advisory

_{Related note}
3635475

_CVSS
8.1

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42916] Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

Security Advisory

_{Related note}
3633002

_CVSS
8.1

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42929] Missing input validation vulnerability in SAP Landscape Transformation Replication Server

Security Advisory

_{Related note}
3581811

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/04/08

Description
[CVE-2025-27428] Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)

Security Advisory

_{Related note}
3620264

_CVSS
6.6

_{Affected system
type}
SAP Commerce Cloud SAP DataHub

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-22228] Security Misconfiguration vulnerability in Spring security within SAP Commerce Cloud and SAP Datahub

Security Advisory

_{Related note}
3611420

_CVSS
6.5

_{Affected system
type}
BI/BO platform

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2023-5072] Denial of Service (DoS) vulnerability due to outdated JSON library used in SAP BusinessObjects Business Intelligence Platform

Security Advisory

_{Related note}
3635587

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42912] Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)

Security Advisory

_{Related note}
3614067

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42930] Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation

Security Advisory

_{Related note}
3643832

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42917] Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application)

Security Advisory

_{Related note}
3647098

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42920] Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management

Security Advisory

_{Related note}
3629325

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42938] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform

Security Advisory

_{Related note}
3409013

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42915] Missing Authorization Check in Fiori app (Manage Payment Blocks)

Security Advisory

_{Related note}
3619465

_CVSS
5.3

_{Affected system
type}
Java

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42926] Missing Authentication check in SAP NetWeaver Application Server Java

Security Advisory

_{Related note}
3627644

_CVSS
5.0

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42911] Missing Authorization check in SAP NetWeaver (Service Data Download)

Security Advisory

_{Related note}
3610322

_CVSS
4.9

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/07/08

Description
[CVE-2025-42961] Missing Authorization check in SAP NetWeaver Application Server for ABAP

Security Advisory

_{Related note}
3640477

_CVSS
4.3

_{Affected system
type}
Java

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42925] Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)

Security Advisory

_{Related note}
3450692

_CVSS
4.3

_{Affected system
type}
SAP Fiori

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42923] Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups)

Security Advisory

_{Related note}
3623504

_CVSS
4.3

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42918] Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing)

Security Advisory

_{Related note}
3624943

_CVSS
3.5

_{Affected system
type}
SAP UI5

_Patchday
2025-09

_{Released
on}
2025/08/12

Description
[CVE-2025-42941] Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)

Security Advisory

_{Related note}
3525295

_CVSS
3.4

_{Affected system
type}
Java

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2025-42927] Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)

Security Advisory

_{Related note}
3632154

_CVSS
3.1

_{Affected system
type}
SAP Commerce Cloud

_Patchday
2025-09

_{Released
on}
2025/09/09

Description
[CVE-2024-13009] Potential Improper Resource Release vulnerability in SAP Commerce Cloud

Security Advisory

Notifications

Severity

SAP© Security advisories 25

System Types

Affected SAP© system types

Related note 3634501

CVSS 10.0

Affected system type Java

Patchday2025-09

Released on2025/09/09

Related note 3643865

CVSS 9.9

Affected system type Java

Patchday2025-09

Released on2025/09/09

Related note 3302162

CVSS 9.6

Affected system type ABAP

Patchday2025-09

Released on2023/03/14

Related note 3627373

CVSS 9.1

Affected system type Kernel

Patchday2025-09

Released on2025/09/09

Related note 3642961

CVSS 8.8

Affected system type SAP Business One

Patchday2025-09

Released on2025/09/09

Related note 3635475

CVSS 8.1

Affected system type ABAP

Patchday2025-09

Released on2025/09/09

Related note 3633002

CVSS 8.1

Affected system type ABAP

Patchday2025-09

Released on2025/09/09

Related note 3581811

CVSS 7.7

Affected system type ABAP

Patchday2025-09

Released on2025/04/08

Related note 3620264

CVSS 6.6

Affected system type SAP Commerce Cloud SAP DataHub

Patchday2025-09

Released on2025/09/09

Related note 3611420

CVSS 6.5

Affected system type BI/BO platform

Patchday2025-09

Released on2025/09/09

Related note 3635587

CVSS 6.5

Affected system type ABAP

Patchday2025-09

Released on2025/09/09

Related note 3614067

CVSS 6.5

Affected system type ABAP

Patchday2025-09

Released on2025/09/09

Related note 3643832

CVSS 6.5

Affected system type ABAP

Patchday2025-09

Released on2025/09/09

Related note 3647098

CVSS 6.1

Affected system type ABAP

Patchday2025-09

Released on2025/09/09

Related note 3629325

CVSS 6.1

Affected system type ABAP

Patchday2025-09

Released on2025/09/09

_{Related note}
3634501

_CVSS
10.0

_{Affected system
type}
Java

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3643865

_CVSS
9.9

_{Affected system
type}
Java

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3302162

_CVSS
9.6

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2023/03/14

_{Related note}
3627373

_CVSS
9.1

_{Affected system
type}
Kernel

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3642961

_CVSS
8.8

_{Affected system
type}
SAP Business One

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3635475

_CVSS
8.1

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3633002

_CVSS
8.1

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3581811

_CVSS
7.7

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/04/08

_{Related note}
3620264

_CVSS
6.6

_{Affected system
type}
SAP Commerce Cloud SAP DataHub

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3611420

_CVSS
6.5

_{Affected system
type}
BI/BO platform

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3635587

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3614067

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3643832

_CVSS
6.5

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3647098

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3629325

_CVSS
6.1

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09

_{Related note}
3409013

_CVSS
5.4

_{Affected system
type}
ABAP

_Patchday
2025-09

_{Released
on}
2025/09/09