SAP Security Patch Day: November 2025
Released November 11, 2025 · 18 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for November 11, 2025 (second Tuesday)
- SAP notes
- 18
- Critical
- 2
- High
- 1
- Highest CVSS
- 10.0
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
18 notes with SAP CVEs. 2 Critical and 1 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)
Code Injection vulnerability in SAP Solution Manager
Memory Corruption vulnerability in SAP CommonCryptoLib
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 18 of 18
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3666261 | Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui) New | SQL Anywhere Monitor | Critical | 10.0 | CVE-2025-42890 |
| 3668705 | Code Injection vulnerability in SAP Solution Manager New | SAP Solution Manager | Critical | 9.9 | CVE-2025-42887 |
| 3633049 | Memory Corruption vulnerability in SAP CommonCryptoLib New | SAP CommonCryptoLib | High | 7.5 | CVE-2025-42940 |
| 3643385 | Code Injection vulnerability in SAP HANA JDBC Client New | SAP HANA JDBC Client | Medium | 6.9 | CVE-2025-42895 |
| 3665900 | OS Command Injection vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.8 | CVE-2025-42892 |
| 3666038 | Path Traversal vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.8 | CVE-2025-42894 |
| 3660969 | JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.5 | CVE-2025-42884 |
| 3642398 | Open Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP) New | SAP S/4HANA landscape | Medium | 6.1 | CVE-2025-42924 |
| 3662000 | Open Redirect vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.1 | CVE-2025-42893 |
| 3665907 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.1 | CVE-2025-42886 |
| 3639264 | Missing authentication in SAP HANA 2.0 (hdbrss) New | SAP HANA 2.0 | Medium | 5.8 | CVE-2025-42885 |
| 3651097 | Information Disclosure vulnerability in SAP GUI for Windows New | SAP GUI for Windows | Medium | 5.5 | CVE-2025-42888 |
| 2886616 | SQL Injection vulnerability in SAP Starter Solution (PL SAFT) New | SAP Starter Solution | Medium | 5.4 | CVE-2025-42889 |
| 3643603 | Information Disclosure vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Medium | 5.3 | CVE-2025-42919 |
| 3652901 | Information Disclosure vulnerability in SAP Business One (SLD) New | SAP Business One | Medium | 5.3 | CVE-2025-42897 |
| 3530544 | Missing Authorization check in SAP S4CORE (Manage Journal Entries) New | SAP S4CORE | Medium | 4.3 | CVE-2025-42899 |
| 3643337 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-42882 |
| 3634053 | Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench) New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 2.7 | CVE-2025-42883 |