CVE-2025-42967

9.9 criticalEPSS 1.0%

Critical (9.9). EPSS 1.0% chance of exploitation in the next 30 days.

SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new report with his own code potentially gaining full control of the affected SAP system causing high impact on confidentiality, integrity, and availability of the application.

Severity

CVSS 3.1

9.9 critical

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2025-07-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://me.sap.com/notes/3618955
https://url.sap/sapsecuritypatchday

Check your stack JSON