Patch Day: December 2025
Released December 9, 2025 · 14 notes · Source: SAP Security Patch Day page
Scheduled for December 9, 2025 (second Tuesday)
- New
- 14
- Updated
- 0
- Critical
- 3
- High
- 5
- Highest CVSS
- 9.9
- Known exploited
- 0
Our summary
14 notes (14 new, 0 updated). 3 Critical and 5 High. Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP Solution Manager
Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud
Deserialization Vulnerability in SAP jConnect - SDK for ASE
Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM)
Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius)
All notes
SAP’s introduction states 14 new notes and 0 updates; SAP’s table lists 14 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 14 of 14
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3685270 | Code Injection vulnerability in SAP Solution Manager New | SAP Solution Manager | Critical | 9.9 | CVE-2025-42880 |
| 3683579 | Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud New | SAP Commerce Cloud | Critical | 9.6 | CVE-2025-55754, CVE-2025-55752 |
| 3685286 | Deserialization Vulnerability in SAP jConnect - SDK for ASE New | SAP jConnect - SDK for ASE | Critical | 9.1 | CVE-2025-42928 |
| 3684682 | Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM) New | SAP Web Dispatcher and Internet Communication Manager | High | 8.2 | CVE-2025-42878 |
| 3640185 | Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius) New | SAP NetWeaver | High | 7.9 | CVE-2025-42874 |
| 3650226 | Denial of service (DOS) in SAP Business Objects New | SAP BusinessObjects BI Platform | High | 7.5 | CVE-2025-48976 |
| 3677544 | Memory Corruption vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server New | SAP Web Dispatcher, Internet Communication Manager and SAP Content Server | High | 7.5 | CVE-2025-42877 |
| 3672151 | Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger) New | SAP S/4 HANA Private Cloud | High | 7.1 | CVE-2025-42876 |
| 3591163 | Missing Authentication check in SAP NetWeaver Internet Communication Framework New | SAP NetWeaver Internet Communication Framework | Medium | 6.6 | CVE-2025-42875 |
| 3662324 | Information Disclosure vulnerability in Application Server ABAP New | Application Server ABAP | Medium | 6.5 | CVE-2025-42904 |
| 3662622 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2025-42872 |
| 3676970 | Denial of Service (DoS) in SAPUI5 framework (Markdown-it component) New | SAPUI5 | Medium | 5.9 | CVE-2025-42873 |
| 3659117 | Missing Authorization check in SAP Enterprise Search for ABAP New | SAP Enterprise Search for ABAP | Medium | 5.5 | CVE-2025-42891 |
| 3651390 | Server-Side Request Forgery (SSRF) in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 5.4 | CVE-2025-42896 |