SAP Security Patch Day: March 2025
Released March 11, 2025 · 19 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for March 11, 2025 (second Tuesday)
- SAP notes
- 19
- Critical
- 0
- High
- 2
- Highest CVSS
- 8.8
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
19 notes with SAP CVEs. 0 Critical and 2 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 8.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 19 of 19
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3563927 | Missing Authorization check in SAP NetWeaver (ABAP Class Builder) New | SAP NetWeaver | High | 8.8 | CVE-2025-26661 |
| 3569602 | Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI) New | SAP Commerce Cloud | High | 8.8 | CVE-2025-27434 |
| 3561045 | Broken Authentication in SAP Business One (Service Layer) New | SAP Business One | Medium | 6.8 | CVE-2025-26658 |
| 3552824 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-26659 |
| 3562390 | Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-25242 |
| 3552144 | Missing Authorization Check in SAP Business Warehouse (Process Chains) New | SAP Business Warehouse | Medium | 5.7 | CVE-2025-25244 |
| 3557469 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) New | SAP BusinessObjects BI Platform | Medium | 5.4 | CVE-2025-25245 |
| 3567246 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 5.4 | CVE-2025-27431 |
| 3561792 | Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component) New | SAP NetWeaver Enterprise Portal | Medium | 5.3 | CVE-2025-23194 |
| 3558132 | Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager New | SAP Web Dispatcher and Internet Communication Manager | Medium | 4.9 | CVE-2025-0071 |
| 3557459 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) New | SAP BusinessObjects BI Platform | Medium | 4.7 | CVE-2025-0062 |
| 3474392 | Missing Authorization check in S/4HANA (Manage Purchasing Info Records) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-26656 |
| 3557131 | Missing Authorization check in SAP S/4HANA (RBD) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-23188 |
| 3557655 | Broken Access Control in SAP Fiori apps (Posting Library) New | SAP Fiori | Medium | 4.3 | CVE-2025-26660 |
| 3565835 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-27433, CVE-2025-27436 |
| 3549494 | Information Disclosure in SAP Business Objects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.1 | CVE-2025-23185 |
| 3561861 | Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center) New | SAP CRM and SAP S/4HANA | Low | 3.5 | CVE-2025-27430 |
| 3347991 | Missing Authorization check in SAP JIT(Outbound) New | SAP Just In Time | Low | 3.1 | CVE-2025-26655 |
| 3568865 | Missing Authorization check in SAP Electronic Invoicing for Brazil (eDocument Cockpit) New | SAP Electronic Invoicing for Brazil | Low | 2.4 | CVE-2025-27432 |