SAP Security Patch Day: July 2025
Released July 8, 2025 · 27 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for July 8, 2025 (second Tuesday)
- SAP notes
- 27
- Critical
- 5
- High
- 3
- Highest CVSS
- 9.9
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
27 notes with SAP CVEs. 5 Critical and 3 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)
Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)
Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network
Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 27 of 27
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3618955 | Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation) New | SAP S/4HANA and SAP SCM | Critical | 9.9 | CVE-2025-42967 |
| 3610892 | Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service) New | SAP NetWeaver | Critical | 9.1 | CVE-2025-42966 |
| 3620498 | Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network New | SAP NetWeaver Enterprise Portal Federated Portal Network | Critical | 9.1 | CVE-2025-42980 |
| 3621236 | Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration New | SAP NetWeaver Enterprise Portal Administration | Critical | 9.1 | CVE-2025-42964 |
| 3621771 | Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer) New | SAP NetWeaver AS Java | Critical | 9.1 | CVE-2025-42963 |
| 3600846 | Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476 New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.1 | CVE-2025-42959 |
| 3623440 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.1 | CVE-2025-42953 |
| 3623255 | Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis New | SAP Business Warehouse and SAP Plug-In Basis | High | 7.7 | CVE-2025-42952 |
| 3595143 | Multiple Privilege Escalation Vulnerabilities in SAPCAR New | SAPCAR | Medium | 6.9 | CVE-2025-42992, CVE-2025-43001 |
| 3596987 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42969 |
| 3604212 | Cross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web 3.5 loading animation) New | SAP Business Warehouse | Medium | 6.1 | CVE-2025-42962 |
| 3617131 | Multiple vulnerabilities in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42956, CVE-2025-42981 |
| 3617380 | Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench New | SAP BusinessObjects Content Administrator workbench | Medium | 6.1 | CVE-2025-42985 |
| 3595156 | Directory Traversal vulnerability in SAPCAR New | SAPCAR | Medium | 5.8 | CVE-2025-42970 |
| 3607513 | Insecure Key & Secret Management vulnerability in SAP GUI for Windows New | SAP GUI for Windows | Medium | 5.6 | CVE-2025-42979 |
| 3540688 | Code Injection vulnerability in SAP FICA ODN framework NewPublished outside Patch Day | SAP FICA ODN framework | Medium | 5.5 | CVE-2025-42947 |
| 3606103 | Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report) New | SAP Data Services | Medium | 5.4 | CVE-2025-42973 |
| 3621037 | Missing Authorization check in SAP NetWeaver (RFC enabled function module) New | SAP NetWeaver | Medium | 5.0 | CVE-2025-42968 |
| 3610322 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.9 | CVE-2025-42961 |
| 3608991 | Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA BEx Tools New | SAP Business Warehouse and SAP BW/4HANA BEx Tools | Medium | 4.3 | CVE-2025-42960 |
| 3610056 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-42974 |
| 3626440 | Missing Authorization check in SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-42986 |
| 3573199 | HTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) New | SAP BusinessObjects BI Platform | Medium | 4.1 | CVE-2025-31326 |
| 3598118 | Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application New | SAP BusinessObjects BI Platform Central Management Console Promotion Management Application | Medium | 4.1 | CVE-2025-42965 |
| 3595141 | Memory Corruption vulnerability in SAPCAR New | SAPCAR | Medium | 4.0 | CVE-2025-42971 |
| 3557179 | Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Low | 3.5 | CVE-2025-42978 |
| 3608156 | Denial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application) New | SAP NetWeaver Business Warehouse | Low | 2.7 | CVE-2025-42954 |