SAP Security Patch Day Addresses 21 Vulnerabilities, 4 Classified as Critical

SAP’s Security Patch Day on 9 September 2025 addressed 21 newly discovered vulnerabilities across its product portfolio, with four issues classified as Critical. The release covers components from NetWeaver to ABAP, S/4HANA and Business One, and four of the fixes carry CVSS scores of 9.0 or higher, signalling serious potential impacts on confidentiality, integrity and availability if unpatched.

According to SAP, the advisory also includes updates to four earlier security notes to refine existing patches, and four Critical issues include insecure deserialization in SAP NetWeaver, insecure file operations in AS Java, directory traversal in ABAP platforms, and missing authentication checks in NetWeaver kernels, among others listed in the vulnerability table.

The report also notes additional High- and Medium-severity flaws across modules such as Business One, S/4HANA replication, and SAP Landscape Transformation, along with two Low-rated flaws covering reverse tabnabbing in Fiori launchpads and an outdated OpenSSL in Adobe Document Services.

The CVE list enumerates entries such as CVE-2025-42944, CVE-2025-42922, CVE-2023-27500 and CVE-2025-42958, with CVSS scores ranging up to 10.0, and SAP recommends customers apply the relevant security notes immediately and follow secure configuration guidance on the SAP Support portal.