Fixes for 27 Flaws, Including 7 Critical

SAP released critical security updates on July 8, 2025, addressing 27 vulnerabilities across its enterprise software portfolio, with seven classified as critical-severity flaws.

The monthly Security Patch Day also included three updates to previously released security notes, underscoring the ongoing security challenges facing enterprise software environments.

The most severe vulnerability, CVE-2025-30012, affects SAP Supplier Relationship Management’s Live Auction Cockpit component and carries a maximum CVSS score of 10.0.

This critical flaw encompasses multiple vulnerabilities, including CVE-2025-30009, CVE-2025-30010, CVE-2025-30011, and CVE-2025-30018, potentially allowing attackers to gain complete system control.

Code injection and deserialization vulnerabilities dominate the critical category, with five additional flaws scoring 9.1 on the CVSS scale.

CVE-2025-42967 represents a code injection vulnerability in SAP S/4HANA and SAP SCM’s Characteristic Propagation component, affecting multiple versions across SCMAPO, S4CORE, S4COREOP, and SCM product lines.

The patches also address SAPCAR vulnerabilities, including privilege escalation (CVE-2025-43001), directory traversal (CVE-2025-42970), and memory corruption (CVE-2025-42971) issues in the SAP archive utility.

SAP strongly recommends immediate patching, particularly for critical vulnerabilities affecting internet-facing systems.

Organizations should prioritize updates based on their specific SAP landscape and exposure levels, with critical patches requiring urgent attention to prevent potential system compromise.

Stay Updated on Daily Cybersecurity News . Follow us on Google News, LinkedIn, and X.