Patch Day: June 2025
Released June 10, 2025 · 14 notes · Source: SAP Security Patch Day page
Scheduled for June 10, 2025 (second Tuesday)
- New
- 14
- Updated
- 0
- Critical
- 1
- High
- 5
- Highest CVSS
- 9.6
- Known exploited
- 0
Our summary
14 notes (14 new, 0 updated). 1 Critical and 5 High. Highest CVSS 9.6.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in SAP NetWeaver Application Server for ABAP
Information Disclosure in SAP GRC (AC Plugin)
Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)
Directory Traversal vulnerability in SAP NetWeaver Visual Composer
All notes
SAP’s introduction states 14 new notes and 0 updates; SAP’s table lists 14 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 14 of 14
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3600840 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.6 | CVE-2025-42989 |
| 3609271 | Information Disclosure in SAP GRC (AC Plugin) New | SAP GRC | High | 8.8 | CVE-2025-42982 |
| 3606484 | Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis New | SAP Business Warehouse and SAP Plug-In Basis | High | 8.5 | CVE-2025-42983 |
| 3560693 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace) New | SAP BusinessObjects BI Platform | High | 8.2 | CVE-2025-23192 |
| 3610591 | Directory Traversal vulnerability in SAP NetWeaver Visual Composer New | SAP NetWeaver Visual Composer | High | 7.6 | CVE-2025-42977 |
| 3610006 | Multiple vulnerabilities in SAP MDM Server New | SAP MDM Server | High | 7.5 | CVE-2025-42994, CVE-2025-42995, CVE-2025-42996 |
| 3580384 | Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement) New | SAP S/4HANA | Medium | 6.7 | CVE-2025-42993 |
| 3590887 | Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation) New | SAP NetWeaver | Medium | 5.8 | CVE-2025-31325 |
| 3441087 | Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application) New | SAP S/4HANA | Medium | 5.4 | CVE-2025-42984 |
| 3594258 | Security misconfiguration vulnerability in SAP Business One Integration Framework New | SAP Business One Integration Framework | Medium | 5.3 | CVE-2025-42998 |
| 3596850 | Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-42987 |
| 3608058 | Missing Authorization check in SAP S/4HANA (Bank Account Application) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-42991 |
| 3585545 | Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Low | 3.7 | CVE-2025-42988 |
| 3601169 | HTML Injection in Unprotected SAPUI5 applications New | SAPUI5 | Low | 3.0 | CVE-2025-42990 |