SAP September 2025 Patch Day fixed 4 critical flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-27500 | An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no data can be read but potentially critical OS files can be over-written making the system unavailable. NVD description · AI analysis pending | 8.1 | <1% |
| — | ||
| CVE-2025-42922 | SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system. NVD description · AI analysis pending | 9.9 | <1% | — | — | ||
| CVE-2025-42944 | Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability. NVD description · AI analysis pending | 10.0 | 3% | — | — | ||
| CVE-2025-42958 | Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modif Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. This results in a high impact on the confidentiality, integrity, and availability of the application. NVD description · AI analysis pending | 9.1 | <1% | — | — |
Full article276 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 09, 2025
SAP issues 21 new and 4 updated security notes, fixing critical NetWeaver flaws enabling RCE and privilege escalation.
SAP this week issued 21 new and four updated security notes as part of the company’s September Patch Day, including four notes that address critical vulnerabilities in NetWeaver.
Onapsis Research Labs supported SAP in patching two critical flaws in NetWeaver AS Java. Note #3634501 addresses an insecure deserialization issue, tracked as CVE-2025-42944 (CVSS score of 10.0), in the RMI-P4 module, enabling unauthenticated RCE via malicious payloads.
“The vulnerability allows an unauthenticated attacker to execute arbitrary OS commands by submitting malicious payload to an open port. A successful exploit can lead to full compromise of the application.” reads the advisory published by Onapsis. “As a temporary workaround, customers should add P4 port filtering at the ICM level to prevent unknown hosts from connecting to the P4 port. “
Note #3643865 fixes an insecure file operations flaw, tracked as CVE-2025-42922 (CVSS score of CVSS 9.9), where non-admin users could upload and execute arbitrary files, risking full system compromise.
SAP also released HotNews Note #3302162 to fix a Directory Traversal flaw, tracked as CVE-2023-27500, in NetWeaver AS ABAP (CVSS score of 9.6). Released in March 2023, it’s now updated with new fixes.
The fourth HotNews issued by SAP addressed a missing authentication check, tracked as CVE-2025-42958 (CVSS score 9.1), in SAP NetWeaver BC-OP-AS4.
The remaining security notes resolve high, medium- and low-severity issues.
It’s unclear if any of these vulnerabilities are being exploited in attacks in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SAP NetWeaver flaw)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/182040/security/sap-september-2025-patch-day-fixed-4-critical-flaws.html