Patch Day: October 2025
Released October 14, 2025 · 19 notes · Source: SAP Security Patch Day page
Scheduled for October 14, 2025 (second Tuesday)
- New
- 13
- Updated
- 6
- Critical
- 4
- High
- 2
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
19 notes (13 new, 6 updated). 4 Critical and 2 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
Security Hardening for Insecure Deserialization in SAP NetWeaver AS Java
Directory Traversal vulnerability in SAP Print Service
Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management
Denial of service (DOS) in SAP Commerce Cloud (Search and Navigation)
All notes
SAP’s introduction states 13 new notes and 4 updates; SAP’s table lists 19 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 19 of 19
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3634501 | Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4) Update | SAP NetWeaver AS Java | Critical | 10.0 | CVE-2025-42944 |
| 3660659 | Security Hardening for Insecure Deserialization in SAP NetWeaver AS Java New | SAP NetWeaver AS Java | Critical | 10.0 | CVE-2025-42944 |
| 3630595 | Directory Traversal vulnerability in SAP Print Service New | SAP Print Service | Critical | 9.8 | CVE-2025-42937 |
| 3647332 | Unrestricted File Upload Vulnerability in SAP Supplier Relationship Management New | SAP Supplier Relationship Management | Critical | 9.0 | CVE-2025-42910 |
| 3664466 | Denial of service (DOS) in SAP Commerce Cloud (Search and Navigation) New | SAP Commerce Cloud | High | 7.5 | CVE-2025-5115 |
| 3658838 | Security Misconfiguration vulnerability in SAP Data Hub Integration Suite New | SAP Data Hub Integration Suite | High | 7.1 | CVE-2025-48913 |
| 3597355 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42942 |
| 3503138 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.0 | CVE-2025-0059 |
| 3441087 | Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application) Update | SAP S/4HANA | Medium | 5.4 | CVE-2025-42984 |
| 3642021 | Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.4 | CVE-2025-42908 |
| 3652788 | Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser) New | SAP Application Server for ABAP | Medium | 5.4 | CVE-2025-42901 |
| 3627308 | Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.3 | CVE-2025-42902 |
| 3634724 | Directory Traversal vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 5.3 | CVE-2025-42906 |
| 3627644 | Missing Authorization check in SAP NetWeaver (Service Data Download) Update | SAP NetWeaver | Medium | 5.0 | CVE-2025-42911 |
| 3577131 | Authorization Bypass vulnerability in SAP NetWeaver Update | SAP NetWeaver | Medium | 4.3 | CVE-2025-31331 |
| 3625683 | Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements) New | SAP S/4HANA | Medium | 4.3 | CVE-2025-42939 |
| 3656781 | User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management New | SAP Financial Service Claims Management | Medium | 4.3 | CVE-2025-42903 |
| 3617142 | Deserialization Vulnerability in SAP BusinessObjects (Web Intelligence and Platform Search) New | SAP BusinessObjects BI Platform | Low | 3.5 | CVE-2025-31672 |
| 3643871 | Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances New | SAP Cloud Appliance Library Appliances | Low | 3.0 | CVE-2025-42909 |