SAP Patches Critical NetWeaver (CVSS Up to 10.0) and High-Severity S/4HANA Flaws

🗓️ 10 Sep 2025 01:03:00Reported by The Hacker NewsType

thn

thn🔗 thehackernews.com👁 16 Views

SAP patches NetWeaver flaws enabling remote code execution and file upload; fixes S/4HANA input.

Reporter	Title	Published	Views	Family All 65
BDU FSTEC	The vulnerability of the functional module of the SAP S/4HANA software platform’s RFC interface allows a perpetrator to execute arbitrary code.	1 Sep 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the RMI-P4 module of the SAP NetWeaver software integration platform allows a perpetrator to execute arbitrary commands.	10 Sep 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of SAP NetWeaver AS Java software integration platforms, related to improper code generation management, allows attackers to load any arbitrary file.	17 Nov 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the SAP NetWeaver software integration platform, related to errors in privilege management, allows a perpetrator to gain access to read, modify, and delete confidential data.	17 Nov 202500:00	–	bdu_fstec
Circl	CVE-2025-42916	9 Sep 202506:47	–	circl
Circl	CVE-2025-42922	9 Sep 202506:01	–	circl
Circl	CVE-2025-42944	9 Sep 202504:31	–	circl
Circl	CVE-2025-42957	12 Aug 202502:43	–	circl
Circl	CVE-2025-42958	9 Sep 202503:01	–	circl
CNNVD	SAP S/4HANA 代码注入漏洞	12 Aug 202500:00	–	cnnvd

10 Sep 2025 06:09Current

8.5High risk

Vulners AI Score8.5

CVSS 3.110

EPSS0.02882

SSVC

netweaver remote code execution file upload authentication missing ibm i series s four hana abap reports data deletion input validation port filtering