Critical SAP S/4HANA Vulnerability Actively Exploited, Allowing Full System Takeover

A critical security flaw in SAP S/4HANA, tracked as CVE-2025-42957, is being actively exploited by attackers, according to SecurityBridge. The vulnerability carries a CVSS score of 9.9 out of 10 and allows a low-privileged user to execute code injection and gain full control of an SAP system. Exploitation requires only a valid SAP user account with access to a vulnerable RFC module and the S_DMIS authorization object with activity 02; no additional user interaction is needed.

SecurityBridge notes that the flaw was first disclosed to SAP on 27 June 2025, and SAP released a fix as part of its August 2025 Patch Day on 11 August 2025. To mitigate risk, customers should apply SAP Security Notes 3627998 and 3633838 without delay, review S_DMIS usage, monitor for unusual RFC requests, and maintain up-to-date backups. The article also warns that a threat actor could start with basic credentials and rapidly escalate to take over the entire SAP environment.