SAP Patches Critical Flaws in SQL Anywhere Monitor, Solution Manager

SAP released 18 new security notes and one updated note in its November 2025 patch day, addressing a range of vulnerabilities across SQL Anywhere Monitor, Solution Manager and related SAP components. The most important note covers CVE-2025-42890, a 10/10 CVSS insecure key and secret management flaw in SQL Anywhere Monitor, which SAP mitigated by removing SQL Anywhere Monitor entirely, according to enterprise application security firm Onapsis.

A second critical issue, CVE-2025-42887 with a 9.9 CVSS, is a remote code injection defect in Solution Manager caused by insufficient input sanitisation. Earlier security notes were updated to harden protections against insecure deserialization in NetWeaver AS Java (CVE-2025-42944) and to address a high-severity memory corruption flaw in CommonCryptoLib (CVE-2025-42940). The patch day also reworks a prior October note addressing an unrestricted file upload flaw in Supplier Relationship Management (CVE-2025-42910).

SecurityWeek notes that SAP has not indicated any exploitation in the wild, but warns that SAP flaws remain a popular target for threat actors.