SAP November 2025 Patch Day Fixes 3 Critical Flaws (CVSS 10) — Including Code Injection and Insecure Key Management

SAP released its November 2025 Patch Day, delivering 18 new security notes and two updates to previously released ones, with three flaws rated CVSS 10.0 that affect SQL Anywhere Monitor (Non-GUI), SAP NetWeaver AS Java, and SAP Solution Manager.

The first critical flaw, CVE-2025-42890, involves SQL Anywhere Monitor (Non-GUI) with baked credentials that could allow unauthenticated attackers to execute arbitrary code or access sensitive environments; SAP described this as exposing resources to unintended users and risking high impact to confidentiality, integrity, and availability.

A second CVSS 10.0 vulnerability, CVE-2025-42944, is a remote code execution risk via insecure deserialization in SAP NetWeaver AS Java’s RMI-P4 module, with exploitation potentially allowing arbitrary OS commands and full system compromise. The third critical issue, CVE-2025-42887 (CVSS 9.9), affects SAP Solution Manager (version ST 720) and enables authenticated attackers to inject and execute arbitrary code through improperly sanitised remote-enabled function calls.

According to the SAP advisory, these flaws underline the urgent need for patching across SAP’s NetWeaver and Solution Manager deployments to mitigate high-impact risks.