SAP Releases Security Update to Fix Critical Code Execution and Injection Flaws

SAP has released a significant security update addressing 18 new vulnerabilities across its enterprise software portfolio, including several critical flaws related to code execution and data injection.

The patch day covers four high-severity issues, the most severe with a CVSS of 10.0, and four CVEs are highlighted: CVE-2025-42890 (Insecure Key & Secret Management in SQL Anywhere Monitor Non-GUI) with 10.0, CVE-2025-42944 (Insecure Deserialization in SAP NetWeaver AS Java) with 10.0, CVE-2025-42887 (Code Injection in SAP Solution Manager) with 9.9, and CVE-2025-42940 (Memory Corruption in SAP CommonCryptoLib) with 7.5.

The disclosures also flag CVE-2025-42895, CVE-2025-42892, CVE-2025-42894 and others as medium or lower severity, including OS command injection, open redirects and XSS among various products. In addition to the critical issues, SAP addressed 14 medium and low-severity vulnerabilities, and administrators are urged to review security notes on the SAP Support Portal and apply patches across their systems, with urgent attention to SQL Anywhere Monitor and NetWeaver AS Java environments.

The update emphasises the need for secure configuration and coordinated patching, as noted by the article published on 11 November 2025, according to SAP Support Portal.