SAP fixed 26 flaws in August 2025 Update, including 4 Critical

SAP’s August 2025 Patch Tuesday released 15 new security notes, including critical fixes, plus four updates to previously released patches.

SAP’s August 2025 Patch Tuesday delivers 15 new security notes, including critical fixes, plus four updates to older patches.

Of a total of 26 vulnerabilities addressed by the company, four have been classified as ‘hot news’ or ‘critical’:

[CVE-2025-42957 (CVSS score of 9.9)] Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise): A flaw in SAP S/4HANA’s RFC-exposed function module lets attackers with user privileges inject ABAP code, bypassing checks and risking full system compromise.

[CVE-2025-42950 (CVSS score of 9.9)] Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform): A vulnerability in SAP Landscape Transformation’s RFC-exposed function module lets privileged users inject ABAP code, bypass checks, and potentially fully compromise the system.

Update to Security Note released on April 2025 Patch Day: [CVE-2025-27429 (CVSS score of 9.9)] Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise): A flaw in SAP S/4HANA’s RFC-exposed function module lets privileged users inject ABAP code, bypass checks, and potentially take full control of the system.

[CVE-2025-42951 (CVSS score of 8.8)] Broken Authorization in SAP Business One (SLD): SAP Business One (SLD) flaw lets authenticated attackers use an API to gain DB admin rights, severely impacting confidentiality, integrity, and availability.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Patch Tuesday)