SAP S/4HANA Critical Vulnerability CVE-2025-42957 Exploited in the Wild
Summary: A command injection vulnerability in SAP S/4HANA, tracked as CVE-2025-42957 with a CVSS score of 9.9, has come under active exploitation in the wild after SAP fixed it in its monthly updates last month. SecurityBridge Threat Research Labs and Pathlock both reported observed exploitation activity, and the flaw allows an attacker with only low-privileged user access to inject arbitrary ABAP code via an RFC-exposed function module, bypass authorization checks, and potentially achieve full system compromise.
Why it matters: Exploitation requires only a low-privileged user account to fully compromise the SAP environment, and reverse engineering the patch to build an exploit is described as relatively easy - so any organization that has not applied SAP's August 2025 security notes remains exposed.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-42957
- Related