Patch days / September 2025

SAP Security Patch Day — September 2025

Tuesday, 9 September 2025

Vulnerabilities: 20
Critical: 3
High: 3
Zero-days: 0
Public exploit: 1

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 3

Critical 10.0
CVE-2025-42944 Public exploit Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
EPSS 3%
Critical 9.9
CVE-2025-42922 Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)
Critical 9.1
CVE-2025-42958 Missing Authentication check in SAP NetWeaver

All vulnerabilities 20

Critical3 Show

Critical 10.0
CVE-2025-42944 Public exploit Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
EPSS 3%
Critical 9.9
CVE-2025-42922 Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)
Critical 9.1
CVE-2025-42958 Missing Authentication check in SAP NetWeaver

High3 Show

Medium11 Show

Low3 Show