SAP has released its November 2025 security patch package containing 20 security notes addressing critical vulnerabilities across enterprise SAP environments. This release includes three HotNews vulnerabilities with CVSS ratings of 10.0 and 9.9, one High priority issue, fourteen Medium priority fixes, and two Low priority updates. The patches affect NetWeaver AS Java, SAP Solution Manager, SAP Business Connector, SAP HANA, CommonCryptoLib, and various application components.
20
3
1
14
2
Executive Summary
- Maximum Severity Insecure Deserialization: CVE-2025-42944 (CVSS 10.0) in NetWeaver AS Java RMI-P4 and CVE-2025-42890 (CVSS 10.0) in SQL Anywhere Monitor allow unauthenticated remote code execution with complete system compromise across connected environments.
- Critical Code Injection: CVE-2025-42887 (CVSS 9.9) in SAP Solution Manager enables authenticated attackers to execute arbitrary code with full system takeover and cross-scope impact.
- Cryptographic Vulnerability: CVE-2025-42940 (CVSS 7.5) memory corruption in SAP CommonCryptoLib causes denial of service affecting cryptographic operations across SAP landscape.
- Multiple Injection Vectors: JNDI injection in NetWeaver Portal, OS command injection in Business Connector, SQL injection in Starter Solution, and code injection in HANA JDBC Client requiring immediate attention.
Critical HotNews Vulnerabilities
Insecure Deserialization in NetWeaver AS Java
Security hardening for insecure deserialization vulnerability in SAP NetWeaver AS Java allows unauthenticated remote attackers to execute arbitrary code without authentication. This maximum severity flaw enables complete system compromise with full confidentiality, integrity, and availability impact across connected environments.
Insecure Key & Secret Management in SQL Anywhere Monitor
Critical insecure key and secret management vulnerability in SQL Anywhere Monitor (Non-Gui) allows unauthenticated remote attackers to compromise cryptographic secrets. Successful exploitation leads to complete system takeover with maximum impact on confidentiality, integrity, and availability across connected systems.
Code Injection in SAP Solution Manager
Critical code injection vulnerability in SAP Solution Manager allows authenticated attackers with low privileges to inject and execute malicious code. The vulnerability has cross-scope impact enabling complete compromise of confidentiality, integrity, and availability across connected systems.
Technical Details: The vulnerability affects function module DSVAS_CHECK_SDCC_IMPORT_PARAMS in function group DSVAS_DEV_DL. Vulnerable component: SAP Solution Manager (ST) Release 720, correction instructions 0020751259 and 0001694331. The flaw allows parameter manipulation during import operations, enabling code injection through improperly validated BDLFUPIMP table entries where IS_DEFAULT is initial.
High Priority Security Issues
Memory Corruption in SAP CommonCryptoLib
Memory corruption vulnerability in SAP CommonCryptoLib allows unauthenticated remote attackers to cause denial of service conditions. As CommonCryptoLib is a foundational cryptographic library used across the SAP landscape, this vulnerability has widespread impact on availability of cryptographic operations.
Medium Priority Vulnerabilities
OS Command Injection in SAP Business Connector
OS command injection vulnerability in SAP Business Connector allows high-privileged attackers on adjacent networks to execute arbitrary operating system commands leading to complete system compromise.
Code Injection in SAP HANA JDBC Client
Code injection vulnerability in SAP HANA JDBC Client allows high-privileged local attackers to inject malicious code with user interaction, resulting in cross-scope impact on availability and partial impact on confidentiality and integrity.
Path Traversal in SAP Business Connector
Path traversal vulnerability in SAP Business Connector enables high-privileged attackers on adjacent networks to access files outside intended directories, potentially leading to unauthorized data access and system compromise.
JNDI Injection in NetWeaver Enterprise Portal
JNDI injection vulnerability in SAP NetWeaver Enterprise Portal allows unauthenticated remote attackers to manipulate JNDI lookups, potentially leading to unauthorized information disclosure and data manipulation.
Reflected XSS in SAP Business Connector
Reflected Cross-Site Scripting vulnerability in SAP Business Connector allows unauthenticated attackers to inject malicious scripts that execute in victims' browsers with cross-scope impact.
Open Redirect in SAP Business Connector
Open redirect vulnerability in SAP Business Connector allows unauthenticated attackers to redirect users to malicious sites, enabling phishing attacks and credential theft with cross-scope impact.
Open Redirect in SAP E-Recruiting
Open redirect vulnerabilities in SAP S/4HANA E-Recruiting BSP component enable unauthenticated attackers to redirect users to external malicious sites for phishing and social engineering attacks.
Missing Authentication in SAP HANA hdbrss
Missing authentication vulnerability in SAP HANA 2.0 hdbrss component allows unauthenticated remote attackers to access sensitive information with cross-scope impact on confidentiality.
Information Disclosure in SAP GUI for Windows
Information disclosure vulnerability in SAP GUI for Windows allows high-privileged local users to access sensitive information with cross-scope impact requiring user interaction.
SQL Injection in SAP Starter Solution
SQL injection vulnerability in SAP Starter Solution (PL SAFT) allows authenticated attackers with low privileges to manipulate SQL queries, leading to unauthorized data access and modification.
Information Disclosure in NetWeaver AS Java
Information disclosure vulnerability in SAP NetWeaver Application Server Java allows unauthenticated remote attackers to access low-level sensitive information from the system.
Information Disclosure in SAP Business One SLD
Information disclosure vulnerability in SAP Business One Service Layer Discovery (SLD) component allows unauthenticated remote attackers to access sensitive system information.
Missing Authorization in NetWeaver ABAP
Missing authorization check vulnerability in SAP NetWeaver Application Server for ABAP allows authenticated users to access information beyond their authorization level.
Missing Authorization in SAP S4CORE
Missing authorization check in SAP S4CORE Manage Journal Entries application allows authenticated users with low privileges to access sensitive financial information.
Low Priority Security Updates
Cache Poisoning in SAP Fiori for SAP ERP
Cache poisoning vulnerability through header manipulation in SAP Fiori for SAP ERP allows authenticated attackers with low privileges to manipulate cached content under complex attack conditions.
Insecure File Operations in NetWeaver ABAP Migration Workbench
Insecure file operations vulnerability in SAP NetWeaver Application Server for ABAP Migration Workbench allows high-privileged administrators to perform limited integrity impact operations.
