CVE-2025-42957criticalobserved exploitationCWE-94

CVE-2025-42957: critical vulnerability in SAP_SE SAP S/4HANA (Private Cloud or On-Premise)

Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

Published · Updated

Follow this CVE+ Monitor SAP S/4HANA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.9epss 1.7%
from disclosure to weapon29 days
Published on NVDAug 12
1st PoC+29d
VulnCheck+23d
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
SAP_SE · SAP S/4HANA (Private Cloud or On-Premise)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SAP_SE SAP S/4HANA (Private Cloud or On-Premise)

In the same product, most dangerous first.

CVE-2025-42916HIGHMissing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)EPSS 0.3%