Critical SAP S/4HANA flaw CVE-2025-42957 under active exploitation

Experts warn of a critical command injection flaw in SAP S/4HANA, tracked as CVE-2025-42957, that is currently under active exploitation. The vulnerability can be exploited from a low-privileged account to fully compromise SAP systems, allowing arbitrary ABAP code injection via the RFC-exposed function module and bypassing key authorisation checks. The advisory notes that attackers could alter databases, create superuser accounts, and steal password hashes, with a CVSS score of 9.9.

The vendor addressed the flaw on 11 August 2025, and SecurityBridge Threat Research Labs confirmed an in-the-wild exploit, urging admins to address the issue immediately. According to SecurityBridge, a complete system compromise with minimal effort is possible, and an attacker could escalate to full control of the SAP environment, even with basic user access obtained through phishing or other means.

The analysis emphasises that unpatched SAP systems are exposed and that exploits can be crafted by reverse‑engineering the ABAP patch, with the attack complexity described as low and executable over the network.