SAP fixed 26 flaws in August 2025 Update, including 4 Critical
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-27429 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system. NVD description · AI analysis pending | 9.9 | <1% | — | — | ||
| CVE-2025-42950 | SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system. NVD description · AI analysis pending | 9.9 | <1% | — | — | ||
| CVE-2025-42951 | Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the correspondin Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result , it has a high impact on the confidentiality, integrity, and availability of the application. NVD description · AI analysis pending | 8.8 | <1% | — | — | ||
| CVE-2025-42957 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system. NVD description · AI analysis pending | 9.9 | 2% | — | — |
Full article242 words · extracted from securityaffairs.com · click to collapse
SAP’s August 2025 Patch Tuesday released 15 new security notes, including critical fixes, plus four updates to previously released patches.
SAP’s August 2025 Patch Tuesday delivers 15 new security notes, including critical fixes, plus four updates to older patches.
Of a total of 26 vulnerabilities addressed by the company, four have been classified as ‘hot news’ or ‘critical’:
[CVE-2025-42957 (CVSS score of 9.9)] Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise): A flaw in SAP S/4HANA’s RFC-exposed function module lets attackers with user privileges inject ABAP code, bypassing checks and risking full system compromise.
[CVE-2025-42950 (CVSS score of 9.9)] Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform): A vulnerability in SAP Landscape Transformation’s RFC-exposed function module lets privileged users inject ABAP code, bypass checks, and potentially fully compromise the system.
Update to Security Note released on April 2025 Patch Day: [CVE-2025-27429 (CVSS score of 9.9)] Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise): A flaw in SAP S/4HANA’s RFC-exposed function module lets privileged users inject ABAP code, bypass checks, and potentially take full control of the system.
[CVE-2025-42951 (CVSS score of 8.8)] Broken Authorization in SAP Business One (SLD): SAP Business One (SLD) flaw lets authenticated attackers use an API to gain DB admin rights, severely impacting confidentiality, integrity, and availability.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Patch Tuesday)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/181085/uncategorized/sap-fixed-26-flaws-in-august-2025-update-including-4-critical.html