SAP Security Patch Day — August 2025

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 2

• Critical 9.9
  CVE-2025-42957 Public exploit Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
  EPSS 1.7%
• Critical 9.9
  CVE-2025-42950 Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)

All vulnerabilities 16