Patch Day: November 2025
Released November 11, 2025 · 22 notes · Source: SAP Security Patch Day page
Scheduled for November 11, 2025 (second Tuesday)
- New
- 18
- Updated
- 4
- Critical
- 3
- High
- 1
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
22 notes (18 new, 4 updated). 3 Critical and 1 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Security Hardening for Insecure Deserialization in SAP NetWeaver AS Java
Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)
Code Injection vulnerability in SAP Solution Manager
Memory Corruption vulnerability in SAP CommonCryptoLib
All notes
SAP’s introduction states 18 new notes and 2 updates; SAP’s table lists 22 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 22 of 22
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3660659 | Security Hardening for Insecure Deserialization in SAP NetWeaver AS Java Update | SAP NetWeaver AS Java | Critical | 10.0 | CVE-2025-42944 |
| 3666261 | Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui) New | SQL Anywhere Monitor | Critical | 10.0 | CVE-2025-42890 |
| 3668705 | Code Injection vulnerability in SAP Solution Manager New | SAP Solution Manager | Critical | 9.9 | CVE-2025-42887 |
| 3633049 | Memory Corruption vulnerability in SAP CommonCryptoLib New | SAP CommonCryptoLib | High | 7.5 | CVE-2025-42940 |
| 3643385 | Code Injection vulnerability in SAP HANA JDBC Client New | SAP HANA JDBC Client | Medium | 6.9 | CVE-2025-42895 |
| 3665900 | OS Command Injection vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.8 | CVE-2025-42892 |
| 3666038 | Path Traversal vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.8 | CVE-2025-42894 |
| 3660969 | JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.5 | CVE-2025-42884 |
| 3642398 | Open Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP) New | SAP S/4HANA landscape | Medium | 6.1 | CVE-2025-42924 |
| 3662000 | Open Redirect vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.1 | CVE-2025-42893 |
| 3665907 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.1 | CVE-2025-42886 |
| 3639264 | Missing authentication in SAP HANA 2.0 (hdbrss) New | SAP HANA 2.0 | Medium | 5.8 | CVE-2025-42885 |
| 3651097 | Information Disclosure vulnerability in SAP GUI for Windows New | SAP GUI for Windows | Medium | 5.5 | CVE-2025-42888 |
| 2886616 | SQL Injection vulnerability in SAP Starter Solution (PL SAFT) New | SAP Starter Solution | Medium | 5.4 | CVE-2025-42889 |
| 3643603 | Information Disclosure vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2025-42919 |
| 3652901 | Information Disclosure vulnerability in SAP Business One (SLD) New | SAP Business One | Medium | 5.3 | CVE-2025-42897 |
| 3610322 | Missing Authorization check in SAP NetWeaver Application Server for ABAP Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.9 | CVE-2025-42961 |
| 3530544 | Missing Authorization check in SAP S4CORE (Manage Journal Entries) New | SAP S4CORE | Medium | 4.3 | CVE-2025-42899 |
| 3626440 | Missing Authorization check in SAP NetWeaver and ABAP Platform Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-42986 |
| 3643337 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-42882 |
| 3426825 | Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP Update | SAP Fiori for SAP ERP | Low | 3.1 | CVE-2025-23191 |
| 3634053 | Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench) New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 2.7 | CVE-2025-42883 |