Vulnerability · Published Aug 12, 2025 · Assigned by sap
CVE-2025-42957Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
Critical 9.9
In plain English
A critical-severity code injection in SAP S/4HANA (Private Cloud or On-Premise) from SAP_SE. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP S/4HANA (Private Cloud or On-Premise) | S4CORE 102103104105106107108 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H