Patch Day: March 2025
Released March 11, 2025 · 25 notes · Source: SAP Security Patch Day page
Scheduled for March 11, 2025 (second Tuesday)
- New
- 22
- Updated
- 3
- Critical
- 0
- High
- 5
- Highest CVSS
- 8.8
- Known exploited
- 0
Our summary
25 notes (22 new, 3 updated). 0 Critical and 5 High. Highest CVSS 8.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)
Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud
Authentication bypass via authorization code injection in SAP Approuter
Missing Authorization check in SAP PDCE
All notes
SAP’s introduction states 21 new notes and 3 updates; SAP’s table lists 25 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 25 of 25
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3563927 | Missing Authorization check in SAP NetWeaver (ABAP Class Builder) New | SAP NetWeaver | High | 8.8 | CVE-2025-26661 |
| 3569602 | Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI) New | SAP Commerce Cloud | High | 8.8 | CVE-2025-27434 |
| 3566851 | Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud New | SAP Commerce Cloud | High | 8.6 | CVE-2024-38286, CVE-2024-52316 |
| 3567974 | Authentication bypass via authorization code injection in SAP Approuter Update | @sap/approuter | High | 8.1 | CVE-2025-24876 |
| 3483344 | Missing Authorization check in SAP PDCE Update | SAP PDCE | High | 7.7 | CVE-2024-39592 |
| 3561045 | Broken Authentication in SAP Business One (Service Layer) New | SAP Business One | Medium | 6.8 | CVE-2025-26658 |
| 3552824 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-26659 |
| 3562390 | Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-25242 |
| 3552144 | Missing Authorization Check in SAP Business Warehouse (Process Chains) New | SAP Business Warehouse | Medium | 5.7 | CVE-2025-25244 |
| 3557469 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) New | SAP BusinessObjects BI Platform | Medium | 5.4 | CVE-2025-25245 |
| 3567246 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 5.4 | CVE-2025-27431 |
| 3561792 | Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component) New | SAP NetWeaver Enterprise Portal | Medium | 5.3 | CVE-2025-23194 |
| 3558132 | Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager New | SAP Web Dispatcher and Internet Communication Manager | Medium | 4.9 | CVE-2025-0071 |
| 3557459 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) New | SAP BusinessObjects BI Platform | Medium | 4.7 | CVE-2025-0062 |
| 3474392 | Missing Authorization check in S/4HANA (Manage Purchasing Info Records) New | S/4HANA On-Premise | Medium | 4.3 | CVE-2025-26656 |
| 3475427 | Information Disclosure vulnerability in SAP Permit to Work Update | SAP Permit to Work | Medium | 4.3 | CVE-2024-41736 |
| 3557131 | Missing Authorization check in SAP S/4HANA (RBD) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-23188 |
| 3557655 | Broken Access Control in SAP Fiori apps (Posting Library) New | SAP Fiori | Medium | 4.3 | CVE-2025-26660 |
| 3565835 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-27433, CVE-2025-27436 |
| 3549494 | Information Disclosure in SAP Business Objects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.1 | CVE-2025-23185 |
| 3562415 | Multiple vulnerabilities in Spring Framework within SAP Commerce Cloud and SAP Datahub New | SAP Commerce Cloud and SAP Datahub | Low | 3.7 | CVE-2024-38819, CVE-2024-38820 |
| 3561861 | Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center) New | SAP CRM and SAP S/4HANA | Low | 3.5 | CVE-2025-27430 |
| 3347991 | Missing Authorization check in SAP JIT(Outbound) New | SAP Just In Time | Low | 3.1 | CVE-2025-26655 |
| 3568865 | Missing Authorization check in SAP Electronic Invoicing for Brazil (eDocument Cockpit) New | SAP Electronic Invoicing for Brazil | Low | 2.4 | CVE-2025-27432 |
| 3576540 | Open Source Security Advisory: Best Practices for Securing Spring Boot Actuator Endpoints for applications running on BTP New | Unspecified | Low | 0.0 | No CVE |