Patch Day: May 2025
Released May 13, 2025 · 20 notes · Source: SAP Security Patch Day page
Scheduled for May 13, 2025 (second Tuesday)
- New
- 16
- Updated
- 4
- Critical
- 2
- High
- 6
- Highest CVSS
- 10.0
- Known exploited
- 2
Our summary
20 notes (16 new, 4 updated). 2 Critical and 6 High. Highest CVSS 10.0. 2 note(s) fix a CVE that is in the CISA KEV catalog.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
Insecure Deserialization in SAP NetWeaver (Visual Composer development server)
Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))
All notes
SAP’s introduction states 16 new notes and 2 updates; SAP’s table lists 20 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 20 of 20
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3594142 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) UpdateKnown exploited | SAP NetWeaver | Critical | 10.0 | CVE-2025-31324 |
| 3604119 | Insecure Deserialization in SAP NetWeaver (Visual Composer development server) NewKnown exploited | SAP NetWeaver | Critical | 9.1 | CVE-2025-42999 |
| 3474398 | Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform Update | SAP BusinessObjects BI Platform | High | 8.7 | CVE-2025-0061, CVE-2025-0060 |
| 3578900 | Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) New | SAP Supplier Relationship Management | High | 8.6 | CVE-2025-30018, CVE-2025-30009, CVE-2025-30010, CVE-2025-30011, CVE-2025-30012 |
| 3600859 | Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL)) New | SAP S/4HANA Cloud Private Edition or on Premise | High | 8.3 | CVE-2025-43010 |
| 3586013 | Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW) New | SAP BusinessObjects BI Platform | High | 7.9 | CVE-2025-43000 |
| 3483344 | Missing Authorization check in SAP PDCE Update | SAP PDCE | High | 7.7 | CVE-2024-39592 |
| 3591978 | Missing Authorization Check in SAP Landscape Transformation (PCL Basis) New | SAP Landscape Transformation | High | 7.7 | CVE-2025-43011 |
| 3577300 | Information Disclosure vulnerability in SAP Gateway Client New | SAP Gateway Client | Medium | 6.6 | CVE-2025-42997 |
| 3596033 | Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise) New | SAP S/4HANA | Medium | 6.4 | CVE-2025-43003 |
| 2491817 | Missing Authorization check in SAP Service Parts Management (SPM) New | SAP Service Parts Management | Medium | 6.3 | CVE-2025-43009 |
| 2719724 | Missing Authorization check in SAP Service Parts Management (SPM) New | SAP Service Parts Management | Medium | 6.3 | CVE-2025-43007 |
| 3577287 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.2 | CVE-2025-31329 |
| 3588455 | Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog) New | SAP Supplier Relationship Management | Medium | 6.1 | CVE-2025-43006 |
| 3585992 | Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal New | SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal | Medium | 5.8 | CVE-2025-43008 |
| 3571096 | Security Misconfiguration Vulnerability in SAP Digital Manufacturing (Production Operator Dashboard) New | SAP Digital Manufacturing | Medium | 5.3 | CVE-2025-43004 |
| 3558755 | Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console New | SAP Data Services Management Console | Medium | 4.4 | CVE-2025-26662 |
| 3227940 | Missing Authorization check in SAP S4/HANA (OData meta-data property) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-43002 |
| 3574520 | Information Disclosure vulnerability in SAP GUI for Windows New | SAP GUI for Windows | Medium | 4.3 | CVE-2025-43005 |
| 3426825 | Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP Update | SAP Fiori for SAP ERP | Low | 3.1 | CVE-2025-23191 |