Patch Day: April 2025
Released April 8, 2025 · 23 notes · Source: SAP Security Patch Day page
Scheduled for April 8, 2025 (second Tuesday)
- New
- 21
- Updated
- 2
- Critical
- 4
- High
- 5
- Highest CVSS
- 10.0
- Known exploited
- 1
Our summary
23 notes (21 new, 2 updated). 4 Critical and 5 High. Highest CVSS 10.0. 1 note(s) fix a CVE that is in the CISA KEV catalog.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
Authentication Bypass Vulnerability in SAP Financial Consolidation
Improper Authorization in SAP BusinessObjects Business Intelligence platform
All notes
SAP’s introduction states 18 new notes and 2 updates; SAP’s table lists 23 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 23 of 23
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3594142 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) NewReleased after Patch DayKnown exploited | SAP NetWeaver | Critical | 10.0 | CVE-2025-31324 |
| 3581961 | Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise) New | SAP S/4HANA | Critical | 9.9 | CVE-2025-27429 |
| 3587115 | Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform) New | SAP Landscape Transformation | Critical | 9.9 | CVE-2025-31330 |
| 3572688 | Authentication Bypass Vulnerability in SAP Financial Consolidation New | SAP Financial Consolidation | Critical | 9.8 | CVE-2025-30016 |
| 3525794 | Improper Authorization in SAP BusinessObjects Business Intelligence platform Update | SAP BusinessObjects BI Platform | High | 8.8 | CVE-2025-0064 |
| 3554667 | Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.5 | CVE-2025-23186 |
| 3590984 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat within SAP Commerce Cloud New | SAP Commerce Cloud | High | 8.1 | CVE-2024-56337 |
| 2927164 | Directory Traversal vulnerability in SAP Capital Yield Tax Management New | SAP Capital Yield Tax Management | High | 7.7 | CVE-2025-30014 |
| 3581811 | Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection) New | SAP NetWeaver AS ABAP / ABAP Platform | High | 7.7 | CVE-2025-27428 |
| 3543274 | Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud) New | SAP Commerce Cloud | Medium | 6.8 | CVE-2025-26654 |
| 3571093 | Code Injection vulnerability in SAP ERP BW Business Content New | SAP ERP BW Business Content | Medium | 6.7 | CVE-2025-30013 |
| 3565751 | Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 6.6 | CVE-2025-31332 |
| 3568307 | Information Disclosure vulnerability in SAP KMC WPC New | SAP KMC WPC | Medium | 5.3 | CVE-2025-26657 |
| 3559307 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2025-26653 |
| 3446649 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution) NewReleased after Patch Day | SAP S/4HANA | Medium | 4.6 | CVE-2025-31328 |
| 3558864 | Missing Authorization check in SAP Solution Manager New | SAP Solution Manager | Medium | 4.4 | CVE-2025-30017 |
| 3359825 | OData meta-data property entity tampering in SAP Field Logistics NewReleased after Patch Day | SAP Field Logistics | Medium | 4.3 | CVE-2025-31327 |
| 3525971 | Odata meta-data tampering in SAP S4CORE entity New | SAP S4CORE entity | Medium | 4.3 | CVE-2025-31333 |
| 3568778 | Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2025-27437 |
| 3577131 | Authorization Bypass vulnerability in SAP NetWeaver New | SAP NetWeaver | Medium | 4.3 | CVE-2025-31331 |
| 3539465 | Information Disclosure Vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 4.2 | CVE-2025-27435 |
| 3565944 | Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2025-30015 |
| 3561861 | Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center) Update | SAP CRM and SAP S/4HANA | Low | 3.5 | CVE-2025-27430 |