CVE-2025-42944 (CVSS 10.0) Among SAP’s Critical Patches

SAP Security Patch Day Addresses 21 Vulnerabilities, 4 Classified as Critical: CVE-2025-42944 (CVSS 10.0)

Estimated reading time: 8 minutes

Key takeaways:

• SAP’s September 9, 2025, Security Patch Day addressed 21 new vulnerabilities.
• Four vulnerabilities are classified as critical, with a CVSS score of 9.0 or higher.
• Organizations should prioritize patching efforts, focusing on the most critical vulnerabilities.
• PurpleOps offers services to help organizations address SAP security vulnerabilities and improve their cybersecurity posture.

Table of Contents:

• Key Vulnerabilities Addressed
• Detailed Breakdown of Vulnerabilities
• Implications for Organizations
• Actionable Advice for Technical and Non-Technical Readers
• How PurpleOps Can Help
• Conclusion
• FAQ

SAP’s Security Patch Day, which took place on September 9, 2025, addressed 21 newly discovered vulnerabilities across its product suite. The updates also included revisions to four previously released security notes. This patch day is especially critical due to the presence of four vulnerabilities classified as critical. Organizations utilizing SAP solutions are advised to prioritize these patches to mitigate potential exploits. Understanding these threats is crucial for maintaining a proactive cybersecurity posture, including leveraging cyber threat intelligence platform to stay ahead of potential attacks.

**Key Vulnerabilities Addressed**

The vulnerabilities span a range of SAP products, including NetWeaver, ABAP platforms, S/4HANA, and Business One modules. Four of these vulnerabilities have a CVSS score of 9.0 or higher, indicating a significant risk to confidentiality, integrity, and availability.

The most critical vulnerabilities include:

• **CVE-2025-42944 – Insecure Deserialization:** This vulnerability, affecting SAP NetWeaver, has a CVSS score of 10.0, the highest possible, indicating maximum severity.
• **CVE-2025-42922 – Insecure File Operations:** Affecting AS Java, this vulnerability has a CVSS score of 9.9.
• **CVE-2023-27500 – Directory Traversal:** This vulnerability impacts ABAP platforms and carries a CVSS score of 9.6.
• **CVE-2025-42958 – Missing Authentication Check:** This vulnerability affects NetWeaver kernels and has a CVSS score of 9.1.

**Detailed Breakdown of Vulnerabilities**

The SAP Security Patch Day on September 9, 2025, fixed a total of 21 vulnerabilities. These can be categorized by severity and impact:

Critical Vulnerabilities (CVSS 9.0 or higher):

• **CVE-2025-42944: Insecure Deserialization (CVSS 10.0)**
  • **Affected Product:** SAP NetWeaver
  • **Impact:** Allows attackers to execute arbitrary code by exploiting the way the system handles deserialization of data. This can lead to complete system compromise.
• **CVE-2025-42922: Insecure File Operations (CVSS 9.9)**
  • **Affected Product:** AS Java
  • **Impact:** Enables attackers to perform unauthorized file operations, potentially leading to data theft, modification, or deletion.
• **CVE-2023-27500: Directory Traversal (CVSS 9.6)**
  • **Affected Product:** ABAP Platforms
  • **Impact:** Allows attackers to access files and directories outside the intended scope, potentially exposing sensitive information or allowing arbitrary code execution.
• **CVE-2025-42958: Missing Authentication Check (CVSS 9.1)**
  • **Affected Product:** NetWeaver Kernels
  • **Impact:** Attackers can bypass authentication mechanisms, gaining unauthorized access to system resources and functionalities.

High Severity Vulnerabilities (CVSS 7.0 – 8.9):

• **CVE-2025-42933: Insecure Storage of Sensitive Information (CVSS 8.8)**
  • **Impact:** Sensitive data is stored in a way that is easily accessible to unauthorized users.
• **CVE-2025-42929: Missing Input Validation (CVSS 8.1)**
  • **Impact:** Insufficient validation of user inputs can lead to injection attacks or other security breaches.
• **CVE-2025-42916: Missing Input Validation (CVSS 8.1)**
  • **Impact:** Similar to CVE-2025-42929, this vulnerability involves inadequate input validation.
• **CVE-2025-27428: Directory Traversal (CVSS 7.7)**
  • **Impact:** Similar to CVE-2023-27500, but potentially with a more limited scope.

Medium Severity Vulnerabilities (CVSS 4.0 – 6.9):

• **CVE-2025-22228: Security Misconfiguration (CVSS 6.6)**
  • **Impact:** Incorrectly configured security settings can create vulnerabilities that attackers can exploit.
• **CVE-2025-42930: Denial of Service (CVSS 6.5)**
  • **Impact:** Attackers can flood the system with requests, making it unavailable to legitimate users.
• **CVE-2025-42912, CVE-2025-42913, CVE-2025-42914: Missing Authorization Check (CVSS 6.5)**
  • **Impact:** Users can access resources or perform actions without proper authorization.
• **CVE-2025-42917: Missing Authorization Check (CVSS 6.5)**
  • **Impact:** Similar to CVE-2025-42912, CVE-2025-42913 and CVE-2025-42914.
• **CVE-2023-5072: Denial of Service (outdated JSON library) (CVSS 6.5)**
  • **Impact:** An outdated JSON library can be exploited to cause a denial-of-service condition.
• **CVE-2025-42920: Cross-Site Scripting (CVSS 6.1)**
  • **Impact:** Attackers can inject malicious scripts into web pages viewed by other users.
• **CVE-2025-42938: Cross-Site Scripting (CVSS 6.1)**
  • **Impact:** Similar to CVE-2025-42920.
• **CVE-2025-42915: Missing Authorization Check (CVSS 5.4)**
  • **Impact:** Users can access resources or perform actions without proper authorization.
• **CVE-2025-42926: Missing Authentication Check (CVSS 5.3)**
  • **Impact:** Attackers can bypass authentication mechanisms, gaining unauthorized access.
• **CVE-2025-42911: Missing Authorization Check (CVSS 5.0)**
  • **Impact:** Users can access resources or perform actions without proper authorization.
• **CVE-2025-42961: Missing Authorization Check (CVSS 4.9)**
  • **Impact:** Users can access resources or perform actions without proper authorization.
• **CVE-2025-42925: Predictable Object Identifier (CVSS 4.3)**
  • **Impact:** Attackers can predict object identifiers, potentially gaining unauthorized access to resources.
• **CVE-2025-42923: Cross-Site Request Forgery (CVSS 4.3)**
  • **Impact:** Attackers can trick users into performing actions they did not intend to.
• **CVE-2025-42918: Missing Authorization Check (CVSS 4.3)**
  • **Impact:** Users can access resources or perform actions without proper authorization.

Low Severity Vulnerabilities (CVSS 0.1 – 3.9):

• **CVE-2025-42941: Reverse Tabnabbing (CVSS 3.5)**
  • **Impact:** Attackers can redirect users to malicious websites by exploiting tab manipulation.
• **CVE-2025-42927: Information Disclosure (Outdated OpenSSL) (CVSS 3.4)**
  • **Impact:** An outdated OpenSSL version can expose sensitive information.
• **CVE-2024-13009: Improper Resource Release (CVSS 3.1)**
  • **Impact:** Failure to properly release resources can lead to resource exhaustion or other issues.

**Implications for Organizations**

These vulnerabilities pose significant risks to organizations running SAP systems. Successful exploitation could lead to:

• **Data Breaches:** Unauthorized access to sensitive business data, impacting customer trust and regulatory compliance.
• **System Downtime:** Denial-of-service attacks or system compromise leading to business disruptions.
• **Financial Losses:** Recovery costs, legal fees, and reputational damage resulting from security incidents.
• **Supply-Chain Risk Monitoring:** Exploitation of vulnerabilities in SAP systems can compromise the entire supply chain, impacting partners and customers.

The urgency of applying these patches cannot be overstated. Organizations should develop and execute a patching strategy that prioritizes the most critical vulnerabilities.

**Actionable Advice for Technical and Non-Technical Readers**

For Technical Readers:

1. **Immediate Patching:** Prioritize applying the patches addressing the critical vulnerabilities (CVSS score of 9.0 or higher) across all affected SAP systems.
2. **Vulnerability Scanning:** Conduct thorough vulnerability scans to identify systems that are susceptible to these vulnerabilities.
3. **Configuration Review:** Review and harden SAP system configurations based on SAP’s security guidance to minimize attack surfaces.
4. **Implement Real-time Ransomware Intelligence:** Integrate threat intelligence feeds to detect and prevent potential exploits targeting these vulnerabilities.
5. **Breach Detection:** Enhance breach detection capabilities to identify any signs of exploitation attempts.
6. **Live Ransomware API:** Utilize live ransomware APIs to stay informed about emerging threats and attack patterns.

For Non-Technical Readers (Business Leaders):

1. **Resource Allocation:** Ensure adequate resources are allocated to the IT and security teams to promptly address these vulnerabilities.
2. **Communication:** Facilitate communication between IT, security, and business units to ensure everyone understands the potential impact and remediation efforts.
3. **Risk Assessment:** Conduct a risk assessment to understand the potential business impact of these vulnerabilities and prioritize patching efforts accordingly.
4. **Cybersecurity Awareness:** Promote cybersecurity awareness among employees to prevent social engineering attacks that could exploit these vulnerabilities.
5. **Dark Web Monitoring Service:** Implement dark web monitoring service to detect leaked credentials or discussions about exploiting these SAP vulnerabilities.
6. **Incident Response Plan:** Ensure that the incident response plan is up-to-date and includes procedures for addressing potential SAP-related security incidents.

**How PurpleOps Can Help**

PurpleOps offers a range of services that can assist organizations in addressing these SAP security vulnerabilities and improving their overall cybersecurity posture. Our offerings include:

• Cyber Threat Intelligence Platform: Providing real-time threat intelligence to identify and prevent potential exploits. This includes monitoring underground forum intelligence to detect early warnings of attacks targeting SAP systems.
• Supply-Chain Risk Monitoring: Assessing and mitigating risks associated with vulnerabilities in SAP systems that could impact the supply chain.
• Breach Detection Services: Implementing advanced breach detection capabilities to identify and respond to security incidents quickly.
• Dark Web Monitoring: Monitoring the dark web for leaked credentials and discussions about exploiting SAP vulnerabilities.
• PurpleOps Solutions: Conducting thorough penetration testing of SAP systems to identify and remediate vulnerabilities before they can be exploited.
• PurpleOps Solutions: Simulating real-world attacks to evaluate the effectiveness of security controls and incident response capabilities.

**Conclusion**

The SAP Security Patch Day on September 9, 2025, highlights the ongoing need for organizations to maintain a proactive cybersecurity posture. Addressing the 21 vulnerabilities, particularly the four critical ones, is essential for protecting sensitive data and ensuring business continuity. By leveraging services like real-time ransomware intelligence and dark web monitoring service, organizations can enhance their ability to detect and respond to emerging threats.

To learn more about how PurpleOps can help you secure your SAP environment and protect your organization from cyber threats, explore our platform or contact us for a PurpleOps Solutions.

FAQ