SAP Patches Critical Net Weaver (CVSS Up to 10.0) and High-Severity S/4HANA Flaws
Summary: SAP released security updates on Tuesday addressing three critical vulnerabilities in SAP NetWeaver, including CVE-2025-42944, which Onapsis says lets an unauthenticated attacker execute arbitrary OS commands by submitting a malicious payload to an open port and can lead to full compromise of the application. The same update set fixes a high-severity missing input validation bug in SAP S/4HANA (CVE-2025-42916, CVSS 8.1) that could let an attacker with high privilege access to ABAP reports delete the contents of arbitrary database tables not protected by an authorization group.
Why it matters: The patches arrive days after SecurityBridge and Pathlock disclosed that CVE-2025-42957, a 9.9-rated S/4HANA defect fixed last month, is already under active exploitation in the wild - so the window between fix and attack is measured in days, not months.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-42916CVE-2025-42944CVE-2025-42957
- Related