SAP Patches Critical NetWeaver (CVSS Up to 10.0) and Previously Exploited S/4HANA Flaws

SAP has issued security updates to address multiple flaws, including three critical vulnerabilities in NetWeaver that could allow code execution or arbitrary file uploads, and a high-severity S/4HANA issue.

The patched flaws include CVE-2025-42944 (CVSS 10.0), a deserialization vulnerability in SAP NetWeaver that could enable OS command execution, CVE-2025-42922 (CVSS 9.9), an insecure file operations vulnerability in SAP NetWeaver AS Java allowing arbitrary file uploads by a non-administrative user, and CVE-2025-42958 (CVSS 9.1), a missing authentication check in the SAP NetWeaver application on IBM i-series.

Onapsis said that CVE-2025-42944 allows an unauthenticated attacker to execute arbitrary OS commands by submitting a malicious payload to an open port, with a path to full compromise of the application. SAP also addressed a high-severity missing input validation bug in S/4HANA (CVE-2025-42916, CVSS 8.1) that could permit deletion of arbitrary database table content by a highly privileged attacker.

The patches arrive days after SecurityBridge and Pathlock disclosed a separate S/4HANA vulnerability (CVE-2025-42957, CVSS 9.9) exploited in the wild, though there is no evidence that the newly disclosed issues have been weaponised yet; users are urged to apply the updates promptly for protection.