补丁日：2025年11月
发布于 2025年11月11日 · 22 条安全说明 · 来源：SAP 安全补丁日页面
计划日期：2025年11月11日（每月第二个星期二）
- 新发布
- 18
- 更新
- 4
- 严重
- 3
- 高
- 1
- 最高 CVSS
- 10.0
- 已被利用
- 0
本月摘要
共 22 条安全说明（新发布 18 条，更新 4 条），其中严重 3 条、高 1 条，最高 CVSS 10.0。
优先修补
排序依据：是否已知被利用（CISA KEV），其次是 SAP 优先级，再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。
Security Hardening for Insecure Deserialization in SAP NetWeaver AS Java
Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)
Code Injection vulnerability in SAP Solution Manager
Memory Corruption vulnerability in SAP CommonCryptoLib
全部安全说明
SAP 简介中写明 18 条新安全说明和 2 条更新；SAP 表格共列出 22 行（两者可能不同，例如包含 GitHub 安全公告或补发条目）。
SAP 公告中的最高优先级在 2024 年 12 月及以前标为 “Hot News”，自 2024 年 10 月起标为 “Critical”；本站统一显示为“严重”。
显示 22 / 22
| 标题 | CVE | ||||
|---|---|---|---|---|---|
| 3660659 | Security Hardening for Insecure Deserialization in SAP NetWeaver AS Java 更新 | SAP NetWeaver AS Java | 严重 | 10.0 | CVE-2025-42944 |
| 3666261 | Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui) 新发布 | SQL Anywhere Monitor | 严重 | 10.0 | CVE-2025-42890 |
| 3668705 | Code Injection vulnerability in SAP Solution Manager 新发布 | SAP Solution Manager | 严重 | 9.9 | CVE-2025-42887 |
| 3633049 | Memory Corruption vulnerability in SAP CommonCryptoLib 新发布 | SAP CommonCryptoLib | 高 | 7.5 | CVE-2025-42940 |
| 3643385 | Code Injection vulnerability in SAP HANA JDBC Client 新发布 | SAP HANA JDBC Client | 中 | 6.9 | CVE-2025-42895 |
| 3665900 | OS Command Injection vulnerability in SAP Business Connector 新发布 | SAP Business Connector | 中 | 6.8 | CVE-2025-42892 |
| 3666038 | Path Traversal vulnerability in SAP Business Connector 新发布 | SAP Business Connector | 中 | 6.8 | CVE-2025-42894 |
| 3660969 | JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal 新发布 | SAP NetWeaver Enterprise Portal | 中 | 6.5 | CVE-2025-42884 |
| 3642398 | Open Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP) 新发布 | SAP S/4HANA landscape | 中 | 6.1 | CVE-2025-42924 |
| 3662000 | Open Redirect vulnerability in SAP Business Connector 新发布 | SAP Business Connector | 中 | 6.1 | CVE-2025-42893 |
| 3665907 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector 新发布 | SAP Business Connector | 中 | 6.1 | CVE-2025-42886 |
| 3639264 | Missing authentication in SAP HANA 2.0 (hdbrss) 新发布 | SAP HANA 2.0 | 中 | 5.8 | CVE-2025-42885 |
| 3651097 | Information Disclosure vulnerability in SAP GUI for Windows 新发布 | SAP GUI for Windows | 中 | 5.5 | CVE-2025-42888 |
| 2886616 | SQL Injection vulnerability in SAP Starter Solution (PL SAFT) 新发布 | SAP Starter Solution | 中 | 5.4 | CVE-2025-42889 |
| 3643603 | Information Disclosure vulnerability in SAP NetWeaver Application Server Java 新发布 | SAP NetWeaver AS Java | 中 | 5.3 | CVE-2025-42919 |
| 3652901 | Information Disclosure vulnerability in SAP Business One (SLD) 新发布 | SAP Business One | 中 | 5.3 | CVE-2025-42897 |
| 3610322 | Missing Authorization check in SAP NetWeaver Application Server for ABAP 更新 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.9 | CVE-2025-42961 |
| 3530544 | Missing Authorization check in SAP S4CORE (Manage Journal Entries) 新发布 | SAP S4CORE | 中 | 4.3 | CVE-2025-42899 |
| 3626440 | Missing Authorization check in SAP NetWeaver and ABAP Platform 更新 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.3 | CVE-2025-42986 |
| 3643337 | Missing Authorization check in SAP NetWeaver Application Server for ABAP 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.3 | CVE-2025-42882 |
| 3426825 | Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP 更新 | SAP Fiori for SAP ERP | 低 | 3.1 | CVE-2025-23191 |
| 3634053 | Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench) 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 低 | 2.7 | CVE-2025-42883 |