SAP Security Patch Day: April 2025
Released April 8, 2025 · 20 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for April 8, 2025 (second Tuesday)
- SAP notes
- 20
- Critical
- 4
- High
- 3
- Highest CVSS
- 10.0
- Known exploited
- 1
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
20 notes with SAP CVEs. 4 Critical and 3 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 10.0. 1 note(s) fix a CVE that is in the CISA KEV catalog.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
Authentication Bypass Vulnerability in SAP Financial Consolidation
Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 20 of 20
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3594142 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) NewPublished outside Patch DayKnown exploited | SAP NetWeaver | Critical | 10.0 | CVE-2025-31324 |
| 3581961 | Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise) New | SAP S/4HANA | Critical | 9.9 | CVE-2025-27429 |
| 3587115 | Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform) New | SAP Landscape Transformation | Critical | 9.9 | CVE-2025-31330 |
| 3572688 | Authentication Bypass Vulnerability in SAP Financial Consolidation New | SAP Financial Consolidation | Critical | 9.8 | CVE-2025-30016 |
| 3554667 | Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.5 | CVE-2025-23186 |
| 2927164 | Directory Traversal vulnerability in SAP Capital Yield Tax Management New | SAP Capital Yield Tax Management | High | 7.7 | CVE-2025-30014 |
| 3581811 | Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) New | SAP NetWeaver AS ABAP / ABAP Platform | High | 7.7 | CVE-2025-27428 |
| 3543274 | Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud) New | SAP Commerce Cloud | Medium | 6.8 | CVE-2025-26654 |
| 3571093 | Code Injection vulnerability in SAP ERP BW Business Content New | SAP ERP BW Business Content | Medium | 6.7 | CVE-2025-30013 |
| 3565751 | Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 6.6 | CVE-2025-31332 |
| 3568307 | Information Disclosure vulnerability in SAP KMC WPC New | SAP KMC WPC | Medium | 5.3 | CVE-2025-26657 |
| 3559307 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2025-26653 |
| 3446649 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution) NewPublished outside Patch Day | SAP S/4HANA | Medium | 4.6 | CVE-2025-31328 |
| 3558864 | Missing Authorization check in SAP Solution Manager New | SAP Solution Manager | Medium | 4.4 | CVE-2025-30017 |
| 3359825 | OData meta-data property entity tampering in SAP Field Logistics NewPublished outside Patch Day | SAP Field Logistics | Medium | 4.3 | CVE-2025-31327 |
| 3525971 | Odata meta-data tampering in SAP S4CORE entity New | SAP S4CORE entity | Medium | 4.3 | CVE-2025-31333 |
| 3568778 | Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-27437 |
| 3577131 | Authorization Bypass vulnerability in SAP NetWeaver New | SAP NetWeaver | Medium | 4.3 | CVE-2025-31331 |
| 3539465 | Information Disclosure Vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 4.2 | CVE-2025-27435 |
| 3565944 | Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2025-30015 |