SAP S/4HANA Critical Vulnerability CVE-2025-42957 Exploited in the Wild

A critical security vulnerability in SAP S/4HANA, tracked as CVE-2025-42957, is being exploited in the wild. According to the NIST National Vulnerability Database, the command injection flaw affects a function module exposed via RFC, enabling an attacker to inject arbitrary ABAP code and bypass essential authorization checks.

Successful exploitation could lead to a full system compromise, allowing attackers to modify the SAP database, create superuser accounts with SAP_ALL privileges, download password hashes, and alter business processes. SecurityBridge Threat Research Labs has observed active exploitation and says the issue affects both on‑premise and Private Cloud editions; exploitation requires only a low-privileged user to fully compromise an SAP system.

The vulnerability carries a CVSS score of 9.9, and SAP fixed it as part of its monthly updates last month. Organisations are urged to apply patches promptly, monitor logs for suspicious RFC calls or new admin users, and consider SAP UCON to restrict RFC usage and review access to authorization object S_DMIS activity 02.