SAP Security Patch Day — December 2025

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 2

• Critical 9.9
  CVE-2025-42880 Code Injection vulnerability in SAP Solution Manager
  EPSS 4.5%
• Critical 9.1
  CVE-2025-42928 Deserialization Vulnerability in SAP jConnect - SDK for ASE
  EPSS 9.8%

All vulnerabilities 12