SAP SE SAP s/4hana Private Cloud Or On-Premise vulnerabilities

2 CVEs affecting SAP SE SAP s/4hana Private Cloud Or On-Premise, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-42916, published 2025-09-09.

More from SAP SE.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-42957, published 2025-08-12. Critical severity, CVSS 9.9. EPSS: 1.6% chance of exploitation in the next 30 days. SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system,…
• CVE-2025-42916, published 2025-09-09. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization…