Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

SAP Releases Security Update to Fix Critical Code Execution and Injection Flaws

SAP has released a significant security update addressing 18 new vulnerabilities across its enterprise software portfolio, including several critical flaws related to code execution and data injection.This monthly security patch day features four…

BBy Brooke SandersNov 12, 20252 min read

SAP has released a significant security update addressing 18 new vulnerabilities across its enterprise software portfolio, including several critical flaws related to code execution and data injection.This monthly security patch day features four high-severity vulnerabilities that require immediate attention from organizations utilizing SAP infrastructure.The most severe vulnerabilities have a CVSS score of 10.0, indicating the highest severity. CVE-2025-42890 affects SQL Anywhere Monitor (Non-GUI) and involves insecure key and secret management, potentially allowing attackers to compromise cryptographic credentials.Similarly critical is CVE-2025-42944, which is an insecure deserialization vulnerability in SAP NetWeaver AS Java. This flaw could enable remote code execution without requiring authentication or user interaction.CVE-2025-42887, a code injection flaw in SAP Solution Manager, has a CVSS score of 9.9. While this vulnerability requires low-level privileges, it could allow attackers to execute arbitrary code within the Solution Manager environment.The fourth critical issue, CVE-2025-42940, is a memory corruption vulnerability in SAP CommonCryptoLib, rated as high severity (7.5 on the CVSS scale). This could lead to denial-of-service attacks or information disclosure.CVE IDVulnerability TypeProductCVSSPriorityCVE-2025-42890Insecure Key & Secret ManagementSQL Anywhere Monitor (Non-GUI)10.0CriticalCVE-2025-42944Insecure DeserializationSAP NetWeaver AS Java10.0CriticalCVE-2025-42887Code InjectionSAP Solution Manager9.9CriticalCVE-2025-42940Memory CorruptionSAP CommonCryptoLib7.5HighCVE-2025-42895Code InjectionSAP HANA JDBC Client6.9MediumCVE-2025-42892OS Command InjectionSAP Business Connector6.8MediumCVE-2025-42894Path TraversalSAP Business Connector6.8MediumCVE-2025-42884JNDI InjectionSAP NetWeaver Enterprise Portal6.5MediumCVE-2025-42924Open RedirectSAP S/4HANA E-Recruiting BSP6.1MediumCVE-2025-42893Open RedirectSAP Business Connector6.1MediumCVE-2025-42886Reflected XSSSAP Business Connector6.1MediumCVE-2025-42885Missing AuthenticationSAP HANA 2.0 (hdbrss)5.8MediumCVE-2025-42888Information DisclosureSAP GUI for Windows5.5MediumCVE-2025-42889SQL InjectionSAP Starter Solution (PL SAFT)5.4MediumCVE-2025-42919Information DisclosureSAP NetWeaver Application Server Java5.3MediumCVE-2025-42897Information DisclosureSAP Business One (SLD)5.3MediumCVE-2025-42899Missing AuthorizationSAP S4CORE (Manage Journal Entries)4.3MediumCVE-2025-42882Missing AuthorizationSAP NetWeaver Application Server ABAP4.3MediumCVE-2025-23191Cache Poisoning via Header ManipulationSAP Fiori for SAP ERP3.1LowCVE-2025-42883Insecure File OperationsSAP NetWeaver ABAP (Migration Workbench)2.7LowIn addition to these critical vulnerabilities, SAP addressed 14 medium and low-severity issues. Notably, CVE-2025-42892 describes an OS command injection vulnerability in SAP Business Connector.At the same time, CVE-2025-42889 addresses SQL injection in SAP Starter Solution, affecting multiple versions.The company also resolved issues related to JNDI injection flaws, open redirects, cross-site scripting, and missing authentication controls across various products.Organizations operating affected SAP systems should prioritize patching based on their deployment architecture.The critical deserialization and key management vulnerabilities pose the highest risk due to their network-accessible nature and minimal exploitation requirements.Urgent attention is needed for SQL Anywhere Monitor and NetWeaver AS Java environments.SAP recommends that administrators review security notes on the SAP Support Portal and systematically apply patches across their systems.The company emphasizes that secure configuration is essential for maintaining data integrity and operational security. Additionally, two previously released security notes have been updated, indicating ongoing refinement of earlier patches.This November patch day highlights the importance of keeping SAP deployments up to date and implementing compensating controls when immediate patching is not feasible.Organizations should collaborate with their SAP support teams to develop deployment strategies that balance security urgency with operational stability.Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Based on reporting by GBHackers.

Advertisement
AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026