SAP Patches Critical Vulnerabilities With December 2025 Security Updates

SAP has rolled out 14 new security notes as part of its December 2025 patch day, three of which are rated critical and affect Solution Manager, Commerce Cloud and the jConnect SDK for SAP ASE. The first critical note fixes CVE-2025-42880, a code-injection flaw in a remote-enabled Solution Manager component that could allow authenticated attackers to inject arbitrary code, according to Onapsis.

A second set of critical flaws, CVE-2025-55754 and CVE-2025-55752, relate to the Apache Tomcat server used in Commerce Cloud and could be exploited for remote code execution, with Tomcat versions 11.0.11, 10.1.45 and 9.0.109 addressing the issue. The third critical note, CVE-2025-42928, is a deserialization vulnerability in the jConnect SDK for ASE that could likewise lead to RCE, according to Onapsis.

SAP’s patch batch also includes five high-severity notes addressing DoS bugs in NetWeaver and Business Objects, plus issues such as information leakage in Web Dispatcher and ICM, memory corruption in Web Dispatcher/ICM/Content Server, and a missing authorization check in SAP S/4HANA Private Cloud, with the remainder of notes classed as medium severity. No exploitation in the wild is mentioned, and users are urged to apply the patches promptly.