SAP Security Patch Day: August 2025
Released August 12, 2025 · 15 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for August 12, 2025 (second Tuesday)
- SAP notes
- 15
- Critical
- 2
- High
- 2
- Highest CVSS
- 9.9
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
15 notes with SAP CVEs. 2 Critical and 2 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
Broken Authorization in SAP Business One (SLD)
Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 15 of 15
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3627998 | Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise) New | SAP S/4HANA | Critical | 9.9 | CVE-2025-42957 |
| 3633838 | Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform) New | SAP Landscape Transformation | Critical | 9.9 | CVE-2025-42950 |
| 3625403 | Broken Authorization in SAP Business One (SLD) New | SAP Business One | High | 8.8 | CVE-2025-42951 |
| 3611184 | Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document) New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.1 | CVE-2025-42975, CVE-2025-42976 |
| 3614804 | Directory Traversal vulnerability in SAP S/4HANA (Bank Communication Management) New | SAP S/4HANA | Medium | 6.9 | CVE-2025-42946 |
| 3585491 | HTML Injection vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42945 |
| 3597355 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42942 |
| 3629871 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42948 |
| 3602656 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.4 | CVE-2025-42936 |
| 3626722 | Missing Authorization check in ABAP Platform New | ABAP Platform | Medium | 4.9 | CVE-2025-42949 |
| 3627845 | Information Disclosure in SAP GUI for Windows New | SAP GUI for Windows | Medium | 4.5 | CVE-2025-42943 |
| 3616863 | CRLF Injection vulnerability in SAP S/4HANA (Supplier invoice) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-42934 |
| 3601480 | Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform(Internet Communication Manager) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2025-42935 |
| 3611345 | Missing authorization check in SAP Cloud Connector New | SAP Cloud Connector | Low | 3.5 | CVE-2025-42955 |
| 3624943 | Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad) New | SAP Fiori | Low | 3.5 | CVE-2025-42941 |