SAP on Tuesday launched security updates to handle a number of security flaws, together with three essential vulnerabilities in SAP Netweaver that might end in code execution and the add arbitrary recordsdata.
The vulnerabilities are listed under –
- CVE-2025-42944 (CVSS rating: 10.0) – A deserialization vulnerability in SAP NetWeaver that might permit an unauthenticated attacker to submit a malicious payload to an open port by means of the RMI-P4 module, leading to working system command execution
- CVE-2025-42922 (CVSS rating: 9.9) – An insecure file operations vulnerability in SAP NetWeaver AS Java that might permit an attacker authenticated as a non-administrative person to add an arbitrary file
- CVE-2025-42958 (CVSS rating: 9.1) – A lacking authentication test vulnerability within the SAP NetWeaver software on IBM i-series that might permit extremely privileged unauthorized customers to learn, modify, or delete delicate info, in addition to entry administrative or privileged functionalities
“[CVE-2025-42944] permits an unauthenticated attacker to execute arbitrary OS instructions by submitting a malicious payload to an open port,” Onapsis stated. “A profitable exploit can result in full compromise of the appliance. As a short lived workaround, prospects ought to add P4 port filtering on the ICM degree to forestall unknown hosts from connecting to the P4 port.”
Additionally addressed by SAP is a high-severity lacking enter validation bug in SAP S/4HANA (CVE-2025-42916, CVSS rating: 8.1) that might allow an attacker with excessive privilege entry to ABAP experiences to delete the content material of arbitrary database tables, ought to the tables not be protected by an authorization group.
The patches arrive days after SecurityBridge and Pathlock disclosed {that a} essential security defect in SAP S/4HANA that was mounted by the corporate final month (CVE-2025-42957, CVSS rating: 9.9) has come below energetic exploitation within the wild.
Whereas there isn’t any proof that the newly disclosed points have been weaponized by dangerous actors, it is important that customers transfer to use the required updates as quickly as attainable for optimum safety.
