Patch Day: August 2025
Released August 12, 2025 · 19 notes · Source: SAP Security Patch Day page
Scheduled for August 12, 2025 (second Tuesday)
- New
- 15
- Updated
- 4
- Critical
- 3
- High
- 2
- Highest CVSS
- 9.9
- Known exploited
- 0
Our summary
19 notes (15 new, 4 updated). 3 Critical and 2 High. Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
Broken Authorization in SAP Business One (SLD)
Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document)
All notes
SAP’s introduction states 15 new notes and 4 updates; SAP’s table lists 19 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 19 of 19
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3581961 | Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise) Update | SAP S/4HANA | Critical | 9.9 | CVE-2025-27429 |
| 3627998 | Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise) New | SAP S/4HANA | Critical | 9.9 | CVE-2025-42957 |
| 3633838 | Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform) New | SAP Landscape Transformation | Critical | 9.9 | CVE-2025-42950 |
| 3625403 | Broken Authorization in SAP Business One (SLD) New | SAP Business One | High | 8.8 | CVE-2025-42951 |
| 3611184 | Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document) New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.1 | CVE-2025-42976, CVE-2025-42975 |
| 3614804 | Directory Traversal vulnerability in SAP S/4HANA (Bank Communication Management) New | SAP S/4HANA | Medium | 6.9 | CVE-2025-42946 |
| 3585491 | HTML Injection vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42945 |
| 3597355 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42942 |
| 3629871 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42948 |
| 3503138 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.0 | CVE-2025-0059 |
| 3602656 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.4 | CVE-2025-42936 |
| 3561792 | Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component) Update | SAP NetWeaver Enterprise Portal | Medium | 5.3 | CVE-2025-23194 |
| 3626722 | Missing Authorization check in ABAP Platform New | ABAP Platform | Medium | 4.9 | CVE-2025-42949 |
| 3627845 | Information Disclosure in SAP GUI for Windows New | SAP GUI for Windows | Medium | 4.5 | CVE-2025-42943 |
| 3577131 | Authorization Bypass vulnerability in SAP NetWeaver Update | SAP NetWeaver | Medium | 4.3 | CVE-2025-31331 |
| 3616863 | CRLF Injection vulnerability in SAP S/4HANA (Supplier invoice) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-42934 |
| 3601480 | Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform(Internet Communication Manager) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.1 | CVE-2025-42935 |
| 3611345 | Missing authorization check in SAP Cloud Connector New | SAP Cloud Connector | Low | 3.5 | CVE-2025-42955 |
| 3624943 | Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad) New | SAP Fiori | Low | 3.5 | CVE-2025-42941 |