CVE-2025-42957: SAP SE SAP s/4hana Private Cloud Or On-Premise

Critical severity, CVSS 9.9. EPSS: 1.6% chance of exploitation in the next 30 days.

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Affected products

• SAP SE SAP s/4hana Private Cloud Or On-Premise: version S4CORE 102 only; version 103 only; version 104 only; version 105 only; version 106 only; version 107 only; …

Published 2025-08-12. Last modified 2026-06-17.