SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerability has a high impact on confidentiality, with no impact on integrity and availability.
Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.
Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim's browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected
Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable them to view information. As a result, it has a low impact on the confidentiality but no impact on the integrity and availability of the system.
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.
Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low impact on the integrity of the application.
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system could further assist this attacker to plan subsequent attacks. As a result, this vulnerability has a low impact on confidentiality, with no impact on the integrity or availability of the application.
CVE-2025-42939 is a medium severity vulnerability in SAP S/4HANA's Manage Processing Rules for Bank Statements module. It allows an authenticated attacker with basic privileges to delete conditions from any shared processing rule by tampering with request parameters, due to missing authorization checks. This compromises the integrity of the application but does not affect confidentiality or availability. The vulnerability affects multiple versions from S4CORE 104 through 109. Exploitation requires authentication but no user interaction. No known exploits are currently reported in the wild. European organizations using SAP S/4HANA for financial processing are at risk of unauthorized modification of bank statement processing rules, potentially disrupting financial workflows and compliance. Mitigation involves applying vendor patches once available, restricting user privileges, and monitoring for anomalous rule changes. Countries with significant SAP S/4HANA adoption and strong financial sectors, such as Germany, France, and the UK, are most likely to be impacted.
SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availability of the application.
Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an attacker could cause high impact on confidentiality, integrity and availability of the application.
CVE-2025-42909 is a low-severity vulnerability in SAP Cloud Appliance Library Appliances, specifically affecting the TITANIUM_WEBAPP 4.0 version. It involves a sensitive cookie lacking the HttpOnly flag due to an insecure default profile setting in S/4HANA appliances. An attacker with high privileges on one appliance could potentially access other appliances by exploiting this cookie vulnerability. The impact on confidentiality is low, and there is no impact on integrity or availability. Exploitation requires network access, high privileges, and no user interaction. No known exploits are currently reported in the wild. European organizations using SAP CAL appliances should review and harden their cookie security settings to mitigate risk. Countries with significant SAP enterprise deployments and critical infrastructure relying on SAP systems are more likely to be affected.
CVE-2025-42908 is a medium-severity Cross-Site Request Forgery (CSRF) vulnerability affecting SAP NetWeaver Application Server for ABAP versions including 7.53, 7.54, 7.77, 7.89, 7.93, and 9.16. An authenticated attacker can exploit this flaw to bypass the initial transaction screen and authorization checks by initiating transactions directly via the session manager. This enables unauthorized execution of actions and transactions that normally require specific permissions, compromising system confidentiality and integrity. The vulnerability does not impact system availability and requires the attacker to have valid user credentials.
CVE-2025-42906 is a medium severity path traversal vulnerability in SAP Commerce Cloud (COM_CLOUD 2211) that allows unauthorized users to access web applications such as the Administration Console from unintended addresses. This bypasses configured access restrictions, potentially exposing sensitive information. The vulnerability impacts confidentiality with no effect on integrity or availability and requires no authentication or user interaction. Exploitation is remote and straightforward due to low attack complexity. No known exploits are currently reported in the wild. European organizations using SAP Commerce Cloud should prioritize patching and access control reviews to mitigate risks.
CVE-2025-42903 is a medium severity vulnerability in SAP Financial Service Claims Management affecting multiple versions. It involves an observable response discrepancy in the RFC function ICL_USER_GET_NAME_AND_ADDRESS, which can be exploited for user enumeration and limited disclosure of personal data. The vulnerability impacts confidentiality with no effect on integrity or availability and requires low privileges but no user interaction. There are no known exploits in the wild, and no patches have been published yet. The affected SAP versions include INSURANCE 803 through 806 and S4CEXT 107 through 109. European organizations using these SAP modules, especially in insurance and financial sectors, could face targeted reconnaissance attempts. Mitigation involves restricting access to the vulnerable RFC function, monitoring for unusual query patterns, and applying SAP security best practices. Countries with significant SAP Financial Services deployments and strong insurance sectors, such as Germany, France, and the UK, are most likely to be affected. The vulnerability’s CVSS score is 4.3, reflecting a medium severity due to limited confidentiality impact and ease of exploitation with privileges.
CVE-2025-42902 is a medium severity vulnerability in SAP NetWeaver AS ABAP and ABAP Platform that allows an unauthenticated attacker to cause a NULL pointer dereference by sending a corrupted SAP Logon or Assertion Ticket. This triggers a crash of the SAP work process, impacting availability but not confidentiality or integrity. The vulnerability affects multiple versions of SAP NetWeaver and ABAP Platform, including widely used releases such as 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 9.x series.
CVE-2025-42901 is a medium-severity vulnerability in SAP Application Server for ABAP's BAPI Browser that allows authenticated attackers to store malicious JavaScript payloads. These payloads can execute in the browsers of users accessing the affected BAPI explorer functionality, potentially compromising confidentiality and integrity. The vulnerability does not impact availability and requires attacker authentication but no user interaction. It affects multiple SAP_BASIS versions from 700 through 816. No known exploits are currently reported in the wild. The CVSS score is 5.4, reflecting moderate risk due to ease of exploitation and limited impact scope. European organizations using affected SAP versions should prioritize patching and implement strict access controls and input validation to mitigate risks. Countries with significant SAP deployments and critical industries relying on SAP ERP systems are most at risk.
SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system.
Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. This results in a high impact on the confidentiality, integrity, and availability of the application.
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability.
CVE-2025-42938 is a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform. An unauthenticated attacker can craft a malicious link that, when clicked by an authenticated user, causes the platform to generate malicious content. This allows the attacker to access or modify information within the victim's browser context, affecting confidentiality and integrity but not availability. The vulnerability affects specific versions of the SAP NetWeaver ABAP Platform.
