SAP Patches Critical Vulnerabilities in NetWeaver, Print Service, SRM

SAP has released 16 new and updated patch notes as part of its October 2025 monthly rollout, including three fresh notes that address critical-severity vulnerabilities. One patch, dated 14 October 2025, fixes CVE-2025-42944, an insecure deserialization flaw in NetWeaver AS Java, with Onapsis noting the security note adds protections and references earlier fixes.

The same update also covers CVE-2025-42937, a directory traversal bug in Print Service that could allow unauthenticated attackers to overwrite system files, and CVE-2025-42910, an unrestricted file upload defect in SRM enabling authentication to upload arbitrary files. In addition, SAP published notes addressing high-severity issues for CVE-2025-5115 (DoS in Commerce Cloud) and CVE-2025-48913 (security misconfiguration in Data Hub Integration Suite). SAP urges users to apply patches and mitigations promptly, while noting that threat actors have targeted SAP bugs in attacks. Written by Ionut Arghire.