SAP Security Patch Day: June 2025
Released June 10, 2025 · 14 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for June 10, 2025 (second Tuesday)
- SAP notes
- 14
- Critical
- 1
- High
- 5
- Highest CVSS
- 9.6
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
14 notes with SAP CVEs. 1 Critical and 5 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.6.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in SAP NetWeaver Application Server for ABAP
Information Disclosure in SAP GRC (AC Plugin)
Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)
Directory Traversal vulnerability in SAP NetWeaver Visual Composer
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 14 of 14
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3600840 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.6 | CVE-2025-42989 |
| 3609271 | Information Disclosure in SAP GRC (AC Plugin) New | SAP GRC | High | 8.8 | CVE-2025-42982 |
| 3606484 | Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis New | SAP Business Warehouse and SAP Plug-In Basis | High | 8.5 | CVE-2025-42983 |
| 3560693 | Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace) New | SAP BusinessObjects BI Platform | High | 8.2 | CVE-2025-23192 |
| 3610591 | Directory Traversal vulnerability in SAP NetWeaver Visual Composer New | SAP NetWeaver Visual Composer | High | 7.6 | CVE-2025-42977 |
| 3610006 | Multiple vulnerabilities in SAP MDM Server New | SAP MDM Server | High | 7.5 | CVE-2025-42994, CVE-2025-42995, CVE-2025-42996 |
| 3580384 | Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement) New | SAP S/4HANA | Medium | 6.7 | CVE-2025-42993 |
| 3590887 | Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation) New | SAP NetWeaver | Medium | 5.8 | CVE-2025-31325 |
| 3441087 | Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application) New | SAP S/4HANA | Medium | 5.4 | CVE-2025-42984 |
| 3594258 | Security misconfiguration vulnerability in SAP Business One Integration Framework New | SAP Business One Integration Framework | Medium | 5.3 | CVE-2025-42998 |
| 3596850 | Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-42987 |
| 3608058 | Missing Authorization check in SAP S/4HANA (Bank Account Application) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-42991 |
| 3585545 | Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Low | 3.7 | CVE-2025-42988 |
| 3601169 | HTML Injection in Unprotected SAPUI5 applications New | SAPUI5 | Low | 3.0 | CVE-2025-42990 |