SAP Security Patch Day — May 2025

Exploited 1

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 9.1
  CVE-2025-42999 Zero-day Insecure Deserialization in SAP NetWeaver (Visual Composer development server)
  EPSS 13%

Critical 1

• Critical 10.0
  CVE-2025-30012 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

All vulnerabilities 20