SAP Security Patch Day: October 2025
Released October 14, 2025 · 9 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for October 14, 2025 (second Tuesday)
- SAP notes
- 9
- Critical
- 2
- High
- 0
- Highest CVSS
- 9.8
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
9 notes with SAP CVEs. 2 Critical and 0 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Directory Traversal vulnerability in SAP Print Service
Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 9 of 9
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3630595 | Directory Traversal vulnerability in SAP Print Service New | SAP Print Service | Critical | 9.8 | CVE-2025-42937 |
| 3647332 | Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management New | SAP Supplier Relationship Management | Critical | 9.0 | CVE-2025-42910 |
| 3642021 | Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.4 | CVE-2025-42908 |
| 3652788 | Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser) New | SAP Application Server for ABAP | Medium | 5.4 | CVE-2025-42901 |
| 3627308 | Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2025-42902 |
| 3634724 | Directory Traversal vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 5.3 | CVE-2025-42906 |
| 3625683 | Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-42939 |
| 3656781 | User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management New | SAP Financial Service Claims Management | Medium | 4.3 | CVE-2025-42903 |
| 3643871 | Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances New | SAP Cloud Appliance Library Appliances | Low | 3.0 | CVE-2025-42909 |