Critical SAP S/4HANA Vulnerability Under Attack, Patch Now

A critical code injection vulnerability in SAP S/4HANA, tracked as CVE-2025-42957, is now under exploitation in the wild, with SAP previously disclosing and patching the flaw. The vulnerability, which carries a 9.9 CVSS score, can allow attackers with low-privileged user access to inject ABAP code and fully compromise the SAP system and host operating system.

It was discovered and reported by SecurityBridge, and according to the SecurityBridge blog post, an exploit has been found in the wild and attackers already know how to use it, leaving unpatched SAP systems exposed. Pathlock also noted outlier activity consistent with exploitation attempts following SAP’s patch release, as its blog post reported.

Security researchers emphasise that with one user account and a remote function call to a vulnerable module, an attacker can gain administrative privileges and manipulate data or create backdoors, making immediate patch application essential, as recommended in SAP’s August 2025 security updates and via SAP’s UCON framework to restrict RFC usage.