SAP Security Patch Day — July 2025

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 5

• Critical 9.9
  CVE-2025-42967 Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)
  EPSS 1%
• Critical 9.1
  CVE-2025-42963 Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer )
• Critical 9.1
  CVE-2025-42964 Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
• Critical 9.1
  CVE-2025-42966 Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)
• Critical 9.1
  CVE-2025-42980 Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network

All vulnerabilities 28