Recent SAP S/4HANA Vulnerability Exploited in Attacks

A critical SAP S/4HANA code injection flaw tracked as CVE-2025-42957 has been exploited in the wild, according to SecurityBridge. The vulnerability, fixed by SAP in August after being responsibly disclosed to the vendor by SecurityBridge in late June, can allow an attacker with low privileges to execute arbitrary code and take full control of the affected SAP system.

SecurityBridge’s director of research, Joris van de Vis, told SecurityWeek that they are not disclosing further details on the attacks at this time, but he confirmed that malicious exploitation has been seen in customer environments and that multiple exploits are known.

The firm said successful exploitation can enable data deletion or insertion in the SAP database, the creation of new SAP users with elevated privileges, password hash downloads, and modifications to business processes, potentially leading to fraud, data theft, espionage or ransomware installation. While not seeing widespread exploitation, organisations are urged to check logs for indicators of compromise such as suspicious RFC calls, new admin users and unexpected ABAP code changes, SecurityBridge warned. CISA’s KEV catalog currently includes 14 SAP product flaws.