SAP Security Patch Day: December 2025
Released December 9, 2025 · 12 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for December 9, 2025 (second Tuesday)
- SAP notes
- 12
- Critical
- 2
- High
- 4
- Highest CVSS
- 9.9
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
12 notes with SAP CVEs. 2 Critical and 4 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP Solution Manager
Deserialization Vulnerability in SAP jConnect - SDK for ASE
Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)
Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius)
Memory Corruption vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 12 of 12
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3685270 | Code Injection vulnerability in SAP Solution Manager New | SAP Solution Manager | Critical | 9.9 | CVE-2025-42880 |
| 3685286 | Deserialization Vulnerability in SAP jConnect - SDK for ASE New | SAP jConnect - SDK for ASE | Critical | 9.1 | CVE-2025-42928 |
| 3684682 | Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM) New | SAP Web Dispatcher and Internet Communication Manager | High | 8.2 | CVE-2025-42878 |
| 3640185 | Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius) New | SAP NetWeaver | High | 7.9 | CVE-2025-42874 |
| 3677544 | Memory Corruption vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server New | SAP Web Dispatcher, Internet Communication Manager and SAP Content Server | High | 7.5 | CVE-2025-42877 |
| 3672151 | Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger) New | SAP S/4 HANA Private Cloud | High | 7.1 | CVE-2025-42876 |
| 3591163 | Missing Authentication check in SAP NetWeaver Internet Communication Framework New | SAP NetWeaver Internet Communication Framework | Medium | 6.6 | CVE-2025-42875 |
| 3662324 | Information Disclosure vulnerability in Application Server ABAP New | Application Server ABAP | Medium | 6.5 | CVE-2025-42904 |
| 3662622 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2025-42872 |
| 3676970 | Denial of Service (DoS) in SAPUI5 framework (Markdown-it component) New | SAPUI5 | Medium | 5.9 | CVE-2025-42873 |
| 3659117 | Missing Authorization check in SAP Enterprise Search for ABAP New | SAP Enterprise Search for ABAP | Medium | 5.5 | CVE-2025-42891 |
| 3651390 | Server-Side Request Forgery (SSRF) in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 5.4 | CVE-2025-42896 |