SAP Security Patch Day Fixes Four Critical Flaws, Including a CVSS 10.0 RCE (CVE-2025-42944)

SAP’s September 2025 Patch Day saw 21 new Security Notes released and 4 updates, with four vulnerabilities rated critical and others also warranting attention for enterprise SAP deployments. The most severe, CVE-2025-42944 in SAP NetWeaver’s RMI-P4, is an unauthenticated remote code execution vulnerability with a CVSS of 10.0, described as arising from insecure deserialization of untrusted Java objects.

Also rated highly is CVE-2025-42922 in SAP NetWeaver AS Java (Deploy Web Service), where an authenticated non-administrative user can upload arbitrary files, giving a CVSS of 9.9 and potential full compromise of the application server. CVE-2023-27500, a directory traversal flaw in SAP NetWeaver AS for ABAP and ABAP Platform, carries a CVSS of 9.6 and can allow overwriting of OS files, potentially causing denial of service.

The fourth critical issue, CVE-2025-42958, concerns a missing authentication check in SAP NetWeaver on IBM i-series, with a CVSS of 9.1 and the potential to read, modify or delete sensitive information or access privileged functionalities.