SAP Security Patch Day: September 2025
Released September 9, 2025 · 19 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for September 9, 2025 (second Tuesday)
- SAP notes
- 19
- Critical
- 3
- High
- 3
- Highest CVSS
- 10.0
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
19 notes with SAP CVEs. 3 Critical and 3 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)
Missing Authentication check in SAP NetWeaver
Insecure Storage of Sensitive Information in SAP Business One (SLD)
Missing input validation vulnerability in SAP Landscape Transformation Replication Server
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 19 of 19
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3670067 | Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4) New | SAP Netweaver | Critical | 10.0 | CVE-2025-42944 |
| 3643865 | Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service) New | SAP NetWeaver AS Java | Critical | 9.9 | CVE-2025-42922 |
| 3627373 | Missing Authentication check in SAP NetWeaver New | SAP NetWeaver | Critical | 9.1 | CVE-2025-42958 |
| 3642961 | Insecure Storage of Sensitive Information in SAP Business One (SLD) New | SAP Business One | High | 8.8 | CVE-2025-42933 |
| 3633002 | Missing input validation vulnerability in SAP Landscape Transformation Replication Server New | SAP Landscape Transformation Replication Server | High | 8.1 | CVE-2025-42929 |
| 3635475 | Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise) New | SAP S/4HANA | High | 8.1 | CVE-2025-42916 |
| 3614067 | Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation New | SAP Business Planning and Consolidation | Medium | 6.5 | CVE-2025-42930 |
| 3635587 | Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application) New | SAP HCM | Medium | 6.5 | CVE-2025-42912, CVE-2025-42913, CVE-2025-42914 |
| 3643832 | Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application) New | SAP HCM | Medium | 6.5 | CVE-2025-42917 |
| 3629325 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42938 |
| 3647098 | Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management New | SAP Supplier Relationship Management | Medium | 6.1 | CVE-2025-42920 |
| 3409013 | Missing Authorization Check in Fiori app (Manage Payment Blocks) New | Fiori app | Medium | 5.4 | CVE-2025-42915 |
| 3619465 | Missing Authentication check in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2025-42926 |
| 3627644 | Missing Authorization check in SAP NetWeaver (Service Data Download) New | SAP NetWeaver | Medium | 5.0 | CVE-2025-42911 |
| 3450692 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups) New | SAP Fiori | Medium | 4.3 | CVE-2025-42923 |
| 3540622 | Server-Side Request Forgery in SAP BI Platform NewPublished outside Patch Day | SAP BI Platform | Medium | 4.3 | CVE-2025-42907 |
| 3623504 | Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-42918 |
| 3640477 | Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service) New | SAP NetWeaver AS Java | Medium | 4.3 | CVE-2025-42925 |
| 3525295 | Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service) New | SAP NetWeaver AS Java | Low | 3.4 | CVE-2025-42927 |