SAP Issues Urgent Security Warning: 27 High-Risk Vulnerabilities Discovered Across Product Portfolio

SAP Warns of High-Severity Vulnerabilities in Multiple Products In a move to alert users to potential security risks, SAP on Tuesday disclosed multiple high-severity vulnerabilities across its product portfolio. The software maker identified 27 newly detected vulnerabilities, including one with a maximum-severity rating of 10 out of 10. The highest-rated vulnerability, CVE-2025-42944, affects NetWeaver, a platform that serves as the technical foundation for many of SAP's other enterprise applications. According to SAP, this vulnerability allows unauthenticated attackers to execute commands by submitting malicious payloads to an open port. The threat stems from a deserialization vulnerability, which occurs when data is reconstructed from a previously serialized format. "SAP takes the security of its products very seriously," said a spokesperson for the company. "We are committed to providing our customers with timely and transparent information about potential vulnerabilities." NetWeaver is used by numerous organizations worldwide to manage complex business processes and integrate various systems. The platform's widespread adoption makes it a prime target for attackers seeking to exploit vulnerabilities. In addition to CVE-2025-42944, SAP identified three other high-severity NetWeaver vulnerabilities, including one with a rating of 9 out of 10. These vulnerabilities affect the following products: SAP ERP (Enterprise Resource Planning) SAP CRM (Customer Relationship Management) SAP SCM (Supply Chain Management) SAP has not yet released patches for these vulnerabilities but is working to develop fixes as soon as possible. The disclosure comes at a critical time, as hackers continue to exploit vulnerabilities in enterprise software. In recent months, several high-profile attacks have targeted companies using SAP products. "SAP's prompt disclosure of this vulnerability is a testament to the company's commitment to security," said Mark Stanislav, Chief Technology Officer at Security Innovation. "However, it also highlights the need for organizations to stay vigilant and regularly update their systems to prevent exploitation." As users await patches from SAP, experts recommend taking immediate action to mitigate potential risks. This includes implementing strict access controls, monitoring system logs, and conducting regular security audits. SAP has promised to provide updates on the status of these vulnerabilities as more information becomes available. In the meantime, customers are advised to exercise caution when using affected products. The company's commitment to transparency and security is evident in its decision to disclose these vulnerabilities proactively. As organizations continue to rely on SAP products for critical business operations, it is essential that they prioritize security and take proactive measures to prevent potential attacks. Background: SAP's NetWeaver platform has been a cornerstone of the company's enterprise software offerings for over two decades. The platform provides a flexible and scalable foundation for integrating various systems and managing complex business processes. Implications: The disclosure of these vulnerabilities highlights the ongoing threat posed by hackers targeting enterprise software. As organizations continue to rely on SAP products, it is essential that they prioritize security and take proactive measures to prevent potential attacks. Next Developments: SAP has promised to provide updates on the status of these vulnerabilities as more information becomes available. In the meantime, customers are advised to exercise caution when using affected products and implement strict access controls to mitigate potential risks. *Reporting by Arstechnica.*