SAP September 2025 Patch Day fixed 4 critical flaws

SAP’s September 2025 Patch Day fixed four critical flaws in NetWeaver as part of 21 new security notes and four updates. Onapsis Research Labs helped SAP patch two critical flaws in NetWeaver AS Java, including CVE-2025-42944 (CVSS 10.0) in the RMI-P4 module that enables unauthenticated RCE via malicious payloads, with the advisory stating that an unauthenticated attacker can execute arbitrary OS commands by submitting a malicious payload to an open port, potentially leading to full compromise of the application.

The same patch set also fixes CVE-2025-42922 (CVSS 9.9) for an insecure file operations flaw that could allow non-admin users to upload and execute arbitrary files, risking full system compromise, and CVE-2023-27500 (CVSS 9.6) in NetWeaver AS ABAP via a Directory Traversal flaw. A fourth vulnerability addressed is CVE-2025-42958 (CVSS 9.1) involving a missing authentication check in SAP NetWeaver BC-OP-AS4, with SAP noting it remains to be seen if any of these flaws are being exploited in the wild.

Follow-up notes indicate the remaining issues are high, medium and low severity, and SAP’s update sequence continues to reflect ongoing risk management as of 9 September 2025.