SAP Security Patch Day – 15 Vulnerabilities Patched including 3 Critical Injection Vulnerabilities

SAP released a comprehensive security update on August 12th, 2025, addressing 15 new vulnerabilities across its enterprise software portfolio, including three critical code injection flaws that pose significant risks to organizations worldwide. 

The monthly Security Patch Day also included four updates to previously released security notes, demonstrating SAP’s ongoing commitment to addressing emerging threats in its enterprise applications. 

Key Takeaways
1.  3 code injection vulnerabilities in S/4HANA and Landscape Transformation allow remote code execution.
2. Low attack complexity with minimal privileges makes these flaws easily exploitable for system compromise.
3. 15 total vulnerabilities across NetWeaver, Business One, and core SAP platforms requiring immediate patching.

Among the most concerning discoveries are injection vulnerabilities affecting core SAP S/4HANA systems and the SAP Landscape Transformation platform, each carrying a maximum CVSS score of 9.9. 

These critical vulnerabilities enable remote code execution with minimal user privileges, potentially allowing attackers to compromise entire SAP landscapes and access sensitive business data.

Critical Code Injection Vulnerabilities 

The three critical vulnerabilities identified in this patch cycle represent some of the most severe security risks ever documented in SAP systems. 

CVE-2025-42957 affects SAP S/4HANA Private Cloud and On-Premise installations across versions S4CORE 102 through 108, enabling authenticated attackers to execute arbitrary code with elevated privileges. 

Similarly, CVE-2025-42950 targets the SAP Landscape Transformation Analysis Platform, affecting multiple DMIS versions from 2011_1_700 to 2020. 

The third critical flaw, CVE-2025-27429, represents an updated security note originally released in April 2025, indicating that additional attack vectors or incomplete remediation may have been discovered since the initial patch.

These injection vulnerabilities exploit inadequate input validation mechanisms within SAP’s ABAP runtime environment, allowing malicious actors to inject and execute unauthorized code through network-accessible interfaces. 

The attack complexity is rated as low (AC:L), requiring only low-level privileges (PR:L) and no user interaction (UI:N), making these vulnerabilities particularly attractive to cybercriminals. 

The scope designation of “Changed” (S:C) indicates that successful exploitation could impact resources beyond the vulnerable component, potentially leading to complete system compromise.

Authorization and Injection Flaws

Beyond the critical injection vulnerabilities, this patch cycle addresses a diverse range of security weaknesses spanning authorization bypasses, cross-site scripting (XSS), and information disclosure issues. 

CVE-2025-42951 in SAP Business One SLD represents a high-severity broken authorization vulnerability with a CVSS score of 8.8, affecting both B1_ON_HANA 10.0 and SAP-M-BO 10.0 versions. 

The SAP NetWeaver Application Server ABAP ecosystem faces multiple security challenges, including CVE-2025-42976, addressing multiple vulnerabilities in BIC Document functionality and several XSS vulnerabilities affecting different platform components.

Medium-severity vulnerabilities include directory traversal flaws in S/4HANA Bank Communication Management (CVE-2025-42946) and HTML injection issues in NetWeaver Application Server ABAP (CVE-2025-42945). 

Additional concerns emerge from missing authorization checks across various SAP_BASIS versions and information disclosure vulnerabilities in the Internet Communication Manager component. 

The security notes also address client-side vulnerabilities, including a reverse tabnabbing issue in SAP Fiori Launchpad (CVE-2025-42941) and information disclosure in SAP GUI for Windows (CVE-2025-42943).

Organizations running SAP systems must prioritize the immediate deployment of these security patches, particularly for the three critical code injection vulnerabilities that could enable complete system compromise. 

SAP recommends that customers visit their Support Portal and apply patches based on priority ratings to protect their enterprise landscapes.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.