Full Report
SAP has released a significant security update addressing 18 new vulnerabilities across its enterprise software portfolio, including several critical flaws related to code execution and data injection. This monthly security patch day features four high-severity vulnerabilities that require immediate attention from organizations utilizing SAP infrastructure. The most severe vulnerabilities have a CVSS score of 10.0, […] The post SAP Releases Security Update to Fix Critical Code Execution and Injection Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
Analysis Summary
As a vulnerability research specialist, here is the summary of the SAP security update based on the provided context:
# Vulnerability: Critical Code Execution and Injection Flaws in SAP Portfolio
## CVE Details (Focusing on Critical/High Severity Items)
| CVE ID | CVSS Score | Severity |
| :--- | :--- | :--- |
| CVE-2025-42890 | 10.0 | Critical |
| CVE-2025-42944 | 10.0 | Critical |
| CVE-2025-42887 | 9.9 | Critical |
| CVE-2025-42940 | 7.5 | High |
- CVE ID: Multiple, starting with CVE-2025-42890
- CVSS Score: Up to 10.0 (Critical)
- CWE: Not explicitly detailed, but includes Insecure Key & Secret Management, Insecure Deserialization, Code Injection, and Memory Corruption.
## Affected Systems
- Products: SAP SQL Anywhere Monitor (Non-GUI), SAP NetWeaver AS Java, SAP Solution Manager, SAP CommonCryptoLib, SAP HANA JDBC Client, SAP Business Connector, SAP NetWeaver Enterprise Portal, SAP S/4HANA E-Recruiting BSP, SAP HANA 2.0 (hdbrss), SAP Starter Solution (PL SAFT), SAP GUI for Windows, SAP NetWeaver Application Server Java/ABAP, SAP Fiori for SAP ERP, SAP NetWeaver ABAP (Migration Workbench).
- Versions: Specific vulnerable versions are not listed, but the context implies they affect organizations utilizing these SAP components.
- Configurations: Varies by CVE; some require low-level privileges (CVE-2025-42887), while others may require no authentication (CVE-2025-42944).
## Vulnerability Description
SAP released updates addressing 18 vulnerabilities, four of which are high-severity requiring immediate attention. The most severe flaws include:
1. **CVE-2025-42890 (CVSS 10.0):** Insecure Key & Secret Management in SQL Anywhere Monitor (Non-GUI), potentially allowing compromise of cryptographic credentials.
2. **CVE-2025-42944 (CVSS 10.0):** Insecure Deserialization in SAP NetWeaver AS Java, leading to Remote Code Execution (RCE) without authentication or user interaction.
3. **CVE-2025-42887 (CVSS 9.9):** Code Injection in SAP Solution Manager, allowing arbitrary code execution within the environment, requiring only low-level privileges.
4. **CVE-2025-42940 (CVSS 7.5):** Memory Corruption in SAP CommonCryptoLib, potentially leading to Denial-of-Service (DoS) or Information Disclosure.
## Exploitation
- Status: The summary implies these vulnerabilities are severe enough to warrant immediate patching, suggesting they pose a high risk, but it **does not explicitly state if they are being exploited in the wild.** PoC availability is unknown based solely on this text.
- Complexity: Varies; CVE-2025-42944 (RCE) implies low complexity if no authentication is required. CVE-2025-42887 requires low-level privileges.
- Attack Vector: Likely Network-based for most critical flaws (RCE, Injection), but specific vectors are not detailed for all CVEs.
## Impact
- Confidentiality: High potential impact due to Information Disclosure (CVE-2025-42940) and potential data compromise via Code Execution/Injection.
- Integrity: High potential impact due to Code Execution (RCE/Arbitrary Code Execution allowing data manipulation).
- Availability: Potential impact via Denial-of-Service (CVE-2025-42940).
## Remediation
### Patches
- SAP has released the monthly security update addressing all 18 vulnerabilities, including the four high/critical severity flaws. Customers must apply the relevant security notes published in the November 2025 patch release.
*Refer to SAP Support for specific patch levels/security notes.*
### Workarounds
- No specific workarounds are detailed in this summary, but organizations should prioritize patching critical systems immediately.
## Detection
- Indicators of Compromise (IOCs): Not specified in the context.
- Detection methods and tools: Standard monitoring tools should be configured to analyze traffic or system logs for indicators related to deserialization attacks, command injection attempts, or unusual cryptographic credential access within the affected SAP components.
## References
- Vendor advisories: SAP Security Notes (November 2025 Update) - [support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html](defanged_support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html)
- Relevant links - defanged: [gbhackers.com/sap-releases-security-update-to-fix-critical-code-execution-and-injection-flaws/](defanged_gbhackers.com/sap-releases-security-update-to-fix-critical-code-execution-and-injection-flaws/)