SAP Security Update – Patch for Critical Vulnerabilities Allowing Code Execution and Injection Attacks

SAP released its monthly Security Patch Day updates, addressing 18 new security notes and providing two updates to existing ones, focusing on vulnerabilities that could enable remote code execution and various injection attacks across its product ecosystem.

These patches are crucial for enterprises relying on SAP systems, as unpatched flaws could expose sensitive data and operational disruptions to threat actors.

SAP urges customers to prioritize applying these fixes via the Support Portal to safeguard their landscapes from potential exploits.​

Among the most severe issues is CVE-2025-42890 in SQL Anywhere Monitor (Non-GUI), version 17.0, which stems from insecure key and secret management practices.

This critical vulnerability, scored at CVSS 10.0, allows unauthenticated attackers over the network to compromise confidentiality, integrity, and availability with high impact, potentially leading to full system takeover through exposed credentials.

Similarly, an update to CVE-2025-42944 in SAP NetWeaver AS Java (SERVERCORE 7.50) reinforces protections against insecure deserialization, maintaining its CVSS 10.0 rating and enabling unauthenticated remote code execution via malicious payloads.

Security experts highlight that such deserialization flaws have been exploited in the wild, underscoring the urgency for immediate patching.​

Another high-impact flaw, CVE-2025-42887 in SAP Solution Manager (ST 720), introduces a code injection vulnerability exploitable by authenticated users with low privileges, earning a CVSS score of 9.9.

Attackers could leverage this to achieve cross-scope escalation, executing arbitrary code and disrupting core business functions. This aligns with broader trends in SAP vulnerabilities where injection attacks target foundational components, amplifying risks in enterprise environments.​

The patch day also tackles multiple injection-related issues at medium severity, including CVE-2025-42892 for OS command injection in SAP Business Connector (version 4.8), CVSS 6.8, which could allow high-privileged adjacent attackers to run unauthorized commands.

CVE-2025-42884 involves JNDI injection in SAP NetWeaver Enterprise Portal (EP-BASIS 7.50), potentially leading to unauthorized lookups and data leaks, rated at CVSS 6.5.

Additionally, CVE-2025-42889 addresses SQL injection in SAP Starter Solution (PL SAFT) across various versions, enabling low-privileged users to manipulate database queries.​

High-severity notes include CVE-2025-42940, a memory corruption issue in SAP CommonCryptoLib (version 8) with CVSS 7.5, which could cause denial-of-service without authentication.

Medium-priority fixes cover path traversal (CVE-2025-42894), open redirects (CVE-2025-42924), reflected XSS (CVE-2025-42886), and missing authentication (CVE-2025-42885) in components like SAP HANA 2.0 and Business One. Lower-severity updates address missing authorizations and cache poisoning in S/4HANA and Fiori.​

SAP November 2025 Vulnerability Details

The following table summarizes the 18 new and 2 updated security notes from SAP’s November 2025 Patch Day, including note numbers, associated CVEs, vulnerability titles, affected products, versions, priorities, and CVSS v3.0 scores. Note#CVETitleProductVersion(s)PriorityCVSS3666261CVE-2025-42890Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)SQL Anywhere Monitor (Non-Gui)SYBASE_SQL_ANYWHERE_SERVER 17.0Critical10.0​3660659 (Update)CVE-2025-42944Security Hardening for Insecure Deserialization in SAP NetWeaver AS JavaSAP NetWeaver AS JavaSERVERCORE 7.50Critical10.0​3668705CVE-2025-42887Code Injection vulnerability in SAP Solution ManagerSAP Solution ManagerST 720Critical9.9​3633049CVE-2025-42940Memory Corruption vulnerability in SAP CommonCryptoLibSAP CommonCryptoLibCRYPTOLIB 8High7.5​3643385CVE-2025-42895Code Injection vulnerability in SAP HANA JDBC ClientSAP HANA JDBC ClientHDB_CLIENT 2.0Medium6.9​3665900CVE-2025-42892OS Command Injection vulnerability in SAP Business ConnectorSAP Business ConnectorSAP BC 4.8Medium6.8​3666038CVE-2025-42894Path Traversal vulnerability in SAP Business ConnectorSAP Business ConnectorSAP BC 4.8Medium6.8​3660969CVE-2025-42884JNDI Injection vulnerability in SAP NetWeaver Enterprise PortalSAP NetWeaver Enterprise PortalEP-BASIS 7.50, EP-RUNTIME 7.50Medium6.5​3642398CVE-2025-42924Open Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP)SAP S/4HANA landscape (SAP E-Recruiting BSP)S4ERECRT 100, 200, ERECRUIT 600, 603, 604, 605, 606, 616, 617, 800, 801, 802Medium6.1​3662000CVE-2025-42893Open Redirect vulnerability in SAP Business ConnectorSAP Business ConnectorSAP BC 4.8Medium6.1​3665907CVE-2025-42886Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business ConnectorSAP Business ConnectorSAP BC 4.8Medium6.1​3639264CVE-2025-42885Missing authentication in SAP HANA 2.0 (hdbrss)SAP HANA 2.0 (hdbrss)HDB 2.00Medium5.8​3651097CVE-2025-42888Information Disclosure vulnerability in SAP GUI for WindowsSAP GUI for WindowsBC-FES-GUI 8.00, 8.10Medium5.5​2886616CVE-2025-42889SQL Injection vulnerability in SAP Starter Solution (PL SAFT)SAP Starter Solution (PL SAFT)SAP_APPL 600, 602, 603, 604, 605, 606, 616, SAP_FIN 617, 618, 700, 720, 730, S4CORE 100, 101, 102, 103, 104Medium5.4​3643603CVE-2025-42919Information Disclosure vulnerability in SAP NetWeaver Application Server JavaSAP NetWeaver Application Server JavaENGINEAPI 7.50, EP-BASIS 7.50Medium5.3​3652901CVE-2025-42897Information Disclosure vulnerability in SAP Business One (SLD)SAP Business One (SLD)B1_ON_HANA 10.0, SAP-M-BO 10.0Medium5.3​3530544CVE-2025-42899Missing Authorization check in SAP S4CORE (Manage Journal Entries)SAP S4CORE (Manage Journal Entries)S4CORE 104, 105, 106, 107, 108Medium4.3​3643337CVE-2025-42882Missing Authorization check in SAP NetWeaver Application Server for ABAPSAP NetWeaver Application Server for ABAPSAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816Medium4.3​3426825 (Update)CVE-2025-23191Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERPSAP Fiori for SAP ERPSAP_GWFND 740, 750, 751, 752, 753, 754, 755, 756, 757, 758Low3.1​3634053CVE-2025-42883Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench)SAP NetWeaver Application Server for ABAP (Migration Workbench)SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816Low2.7​ These vulnerabilities highlight ongoing challenges in SAP’s legacy and modern stacks, where code execution paths remain prime targets for advanced persistent threats.

Enterprises should conduct vulnerability scans, segment networks, and test patches in staging before production rollout to mitigate risks. By addressing these flaws promptly, organizations can maintain resilience against evolving cyber threats in mission-critical SAP deployments.​

Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories.

Based on reporting by Cyber Security News.