Patch Day: September 2025
Released September 9, 2025 · 27 notes · Source: SAP Security Patch Day page
Scheduled for September 9, 2025 (second Tuesday)
- New
- 22
- Updated
- 5
- Critical
- 4
- High
- 4
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
27 notes (22 new, 5 updated). 4 Critical and 4 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)
Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
Missing Authentication check in SAP NetWeaver
Insecure Storage of Sensitive Information in SAP Business One (SLD)
All notes
SAP’s introduction states 21 new notes and 5 updates; SAP’s table lists 27 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 27 of 27
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3634501 | Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4) New | SAP Netweaver | Critical | 10.0 | CVE-2025-42944 |
| 3643865 | Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service) New | SAP NetWeaver AS Java | Critical | 9.9 | CVE-2025-42922 |
| 3302162 | Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform Update | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.6 | CVE-2023-27500 |
| 3627373 | Missing Authentication check in SAP NetWeaver New | SAP NetWeaver | Critical | 9.1 | CVE-2025-42958 |
| 3642961 | Insecure Storage of Sensitive Information in SAP Business One (SLD) New | SAP Business One | High | 8.8 | CVE-2025-42933 |
| 3633002 | Missing input validation vulnerability in SAP Landscape Transformation Replication Server New | SAP Landscape Transformation Replication Server | High | 8.1 | CVE-2025-42929 |
| 3635475 | Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise) New | SAP S/4HANA | High | 8.1 | CVE-2025-42916 |
| 3581811 | Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) Update | SAP NetWeaver AS ABAP / ABAP Platform | High | 7.7 | CVE-2025-27428 |
| 3620264 | Security Misconfiguration vulnerability in Spring security within SAP Commerce Cloud and SAP Datahub New | SAP Commerce Cloud and SAP Datahub | Medium | 6.6 | CVE-2025-22228 |
| 3611420 | Denial of Service (DoS) vulnerability due to outdated JSON library used in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 6.5 | CVE-2023-5072 |
| 3614067 | Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation New | SAP Business Planning and Consolidation | Medium | 6.5 | CVE-2025-42930 |
| 3635587 | Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) New | SAP HCM | Medium | 6.5 | CVE-2025-42912, CVE-2025-42913, CVE-2025-42914 |
| 3643832 | Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application) New | SAP HCM | Medium | 6.5 | CVE-2025-42917 |
| 3629325 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42938 |
| 3647098 | Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management New | SAP Supplier Relationship Management | Medium | 6.1 | CVE-2025-42920 |
| 3409013 | Missing Authorization Check in Fiori app (Manage Payment Blocks) New | Fiori app | Medium | 5.4 | CVE-2025-42915 |
| 3619465 | Missing Authentication check in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2025-42926 |
| 3627644 | Missing Authorization check in SAP NetWeaver (Service Data Download) New | SAP NetWeaver | Medium | 5.0 | CVE-2025-42911 |
| 3610322 | Missing Authorization check in SAP NetWeaver Application Server for ABAP Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.9 | CVE-2025-42961 |
| 3450692 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups) New | SAP Fiori | Medium | 4.3 | CVE-2025-42923 |
| 3540622 | Server-Side Request Forgery in SAP BI Platform NewReleased after Patch Day | SAP BI Platform | Medium | 4.3 | CVE-2025-42907 |
| 3577131 | Authorization Bypass vulnerability in SAP NetWeaver Update | SAP NetWeaver | Medium | 4.3 | CVE-2025-31331 |
| 3623504 | Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-42918 |
| 3640477 | Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service) New | SAP NetWeaver AS Java | Medium | 4.3 | CVE-2025-42925 |
| 3624943 | Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad) Update | SAP Fiori | Low | 3.5 | CVE-2025-42941 |
| 3525295 | Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service) New | SAP NetWeaver AS Java | Low | 3.4 | CVE-2025-42927 |
| 3632154 | Potential Improper Resource Release vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Low | 3.1 | CVE-2024-13009 |