CVE-2025-42991: SAP SE SAP s/4hana Bank Account Application

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account application of other user, leading to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application.

Affected products

• SAP SE SAP s/4hana Bank Account Application: version S4CORE 108 only

Published 2025-06-10. Last modified 2026-06-17.