Patch Day: July 2025
Released July 8, 2025 · 33 notes · Source: SAP Security Patch Day page
Scheduled for July 8, 2025 (second Tuesday)
- New
- 28
- Updated
- 5
- Critical
- 6
- High
- 5
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
33 notes (28 new, 5 updated). 6 Critical and 5 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)
Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)
Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network
Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
All notes
SAP’s introduction states 27 new notes and 4 updates; SAP’s table lists 33 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 33 of 33
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3578900 | Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) Update | SAP Supplier Relationship Management | Critical | 10.0 | CVE-2025-30012, CVE-2025-30009, CVE-2025-30010, CVE-2025-30011, CVE-2025-30018 |
| 3618955 | Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation) New | SAP S/4HANA and SAP SCM | Critical | 9.9 | CVE-2025-42967 |
| 3610892 | Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service) New | SAP NetWeaver | Critical | 9.1 | CVE-2025-42966 |
| 3620498 | Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network New | SAP NetWeaver Enterprise Portal Federated Portal Network | Critical | 9.1 | CVE-2025-42980 |
| 3621236 | Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration New | SAP NetWeaver Enterprise Portal Administration | Critical | 9.1 | CVE-2025-42964 |
| 3621771 | Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer) New | SAP NetWeaver AS Java | Critical | 9.1 | CVE-2025-42963 |
| 3600846 | Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476 New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.1 | CVE-2025-42959 |
| 3623440 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.1 | CVE-2025-42953 |
| 3565279 | Insecure File Operations vulnerability in SAP Business Objects Business Intelligence Platform (CMC) New | SAP BusinessObjects BI Platform | High | 8.0 | CVE-2024-53677 |
| 3623255 | Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis New | SAP Business Warehouse and SAP Plug-In Basis | High | 7.7 | CVE-2025-42952 |
| 3610591 | Directory Traversal vulnerability in SAP NetWeaver Visual Composer Update | SAP NetWeaver Visual Composer | High | 7.6 | CVE-2025-42977 |
| 3595143 | Multiple Privilege Escalation Vulnerabilities in SAPCAR New | SAPCAR | Medium | 6.9 | CVE-2025-43001, CVE-2025-42992 |
| 3580384 | Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement) Update | SAP S/4HANA | Medium | 6.7 | CVE-2025-42993 |
| 3577300 | Information Disclosure vulnerability in SAP Gateway Client Update | SAP Gateway Client | Medium | 6.6 | CVE-2025-42997 |
| 3596987 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42969 |
| 3604212 | Cross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web 3.5 loading animation) New | SAP Business Warehouse | Medium | 6.1 | CVE-2025-42962 |
| 3617131 | Multiple vulnerabilities in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42981, CVE-2025-42956 |
| 3617380 | Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench New | SAP BusinessObjects Content Administrator workbench | Medium | 6.1 | CVE-2025-42985 |
| 3585992 | Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal UpdateReleased after Patch Day | SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal | Medium | 5.8 | CVE-2025-43008 |
| 3595156 | Directory Traversal vulnerability in SAPCAR New | SAPCAR | Medium | 5.8 | CVE-2025-42970 |
| 3607513 | Insecure Key & Secret Management vulnerability in SAP GUI for Windows New | SAP GUI for Windows | Medium | 5.6 | CVE-2025-42979 |
| 3540688 | Code Injection vulnerability in SAP FICA ODN framework NewReleased after Patch Day | SAP FICA ODN framework | Medium | 5.5 | CVE-2025-42947 |
| 3606103 | Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report) New | SAP Data Services | Medium | 5.4 | CVE-2025-42973 |
| 3621037 | Missing Authorization check in SAP NetWeaver (RFC enabled function module) New | SAP NetWeaver | Medium | 5.0 | CVE-2025-42968 |
| 3610322 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.9 | CVE-2025-42961 |
| 3608991 | Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA BEx Tools New | SAP Business Warehouse and SAP BW/4HANA BEx Tools | Medium | 4.3 | CVE-2025-42960 |
| 3610056 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-42974 |
| 3626440 | Missing Authorization check in SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-42986 |
| 3573199 | HTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) New | SAP BusinessObjects BI Platform | Medium | 4.1 | CVE-2025-31326 |
| 3598118 | Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application New | SAP BusinessObjects BI Platform Central Management Console Promotion Management Application | Medium | 4.1 | CVE-2025-42965 |
| 3595141 | Memory Corruption vulnerability in SAPCAR New | SAPCAR | Medium | 4.0 | CVE-2025-42971 |
| 3557179 | Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Low | 3.5 | CVE-2025-42978 |
| 3608156 | Denial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application) New | SAP NetWeaver Business Warehouse | Low | 2.7 | CVE-2025-42954 |