CVE-2025-42876: SAP SE SAP s/4 Hana Private Cloud Financials General Ledger

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all company codes. Successful exploitation could result in a high impact to confidentiality and a low impact to integrity, while availability remains unaffected.

Affected products

• SAP SE SAP s/4 Hana Private Cloud Financials General Ledger: version S4CORE 104 only; version 105 only; version 106 only; version 107 only; version 108 only; version 109 only

Published 2025-12-09. Last modified 2026-10-07.