Full Report
A critical SAP S/4HANA code injection vulnerability is being leveraged in attacks in the wild to breach exposed servers, researchers warn. [...]
Analysis Summary
# Vulnerability: Critical SAP S/4HANA ABAP Code Injection Allowing Full System Takeover
## CVE Details
- CVE ID: CVE-2025-42957
- CVSS Score: 9.9 (Critical)
- CWE: Code Injection (Inferred from description)
## Affected Systems
- Products: SAP S/4HANA (Private Cloud or On-Premise), Landscape Transformation (Analysis Platform), Business One (SLD), NetWeaver Application Server ABAP (BIC Document)
- Versions:
- S/4HANA: S4CORE versions 102, 103, 104, 105, 106, 107, 108
- DMIS: 2011\_1\_700, 2011\_1\_710, 2011\_1\_730, 2011\_1\_731, 2011\_1\_752, 2020
- B1\_ON\_HANA: 10.0, SAP-M-BO: 10.0
- S4COREOP: 104, 105, 106, 107, 108
- SEM-BW: 600, 602, 603, 604, 605, 634, 736, 746, 747, 748
- Configurations: RFC-exposed function module susceptible to injection. Affects low-privileged authentication users.
## Vulnerability Description
This vulnerability is an ABAP code injection flaw within an RFC-exposed function module of SAP S/4HANA systems. A low-privileged authenticated user can inject arbitrary code into the system. Successful exploitation allows the attacker to bypass authorization controls, potentially leading to full system takeover, data theft, data manipulation, privilege escalation (via backdoor account creation), and operational disruption (ransomware/malware). The ABAP code being open for inspection makes patch reverse engineering relatively easy for skilled actors.
## Exploitation
- Status: Exploited in the wild
- Complexity: Low (For highly skilled/knowledgeable threat actors, as exploiting is trivial after patch reverse engineering)
- Attack Vector: Network (Implied by RFC exposure and general context of SAP network access)
## Impact
- Confidentiality: High (Data theft, credential theft)
- Integrity: High (Data manipulation, code injection)
- Availability: High (Operational disruption via malware/ransomware)
## Remediation
### Patches
- SAP fixed this vulnerability in the August 2025 Patch Day. Administrators must apply the relevant security updates released on August 11, 2025.
- Reference SAP Note: [me/notes/3627998] (Customer login required for details)
### Workarounds
- No specific workarounds were detailed in the summary, but immediate patching is strongly advised due to active exploitation. Limiting access to RFC-exposed function modules if possible might reduce exposure until patching is complete.
## Detection
- Indicators of compromise include evidence of unauthorized login/account creation, unexpected system commands execution on SAP servers, or data exfiltration patterns targeting SAP databases.
- Detection methods would involve monitoring network traffic to known RFC ports for suspicious ABAP payloads or leveraging security monitoring tools for unauthorized system command execution originating from the SAP application layer.
## References
- Vendor Advisory: support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2025.html
- Security Research Report: securitybridge.com/blog/critical-sap-s-4hana-code-injection-vulnerability-cve-2025-42957/
- SAP Customer Note: me/notes/3627998