SAP Security Patch Day — March 2023

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 5

• Critical 9.9
  CVE-2023-23857 Improper Access Control in SAP NetWeaver AS for Java
• Critical 9.9
  CVE-2023-25616 Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)
• Critical 9.6
  CVE-2023-27269 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
• Critical 9.6
  CVE-2023-27500 Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
• Critical 9.0
  CVE-2023-25617 OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)

All vulnerabilities 22