CVE-2025-43009

6.3 mediumEPSS 0.3%

Medium (6.3). EPSS 0.3% chance of exploitation in the next 30 days.

SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on Confidentiality, integrity and availability of the application.

Severity

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2025-05-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://me.sap.com/notes/2491817
https://url.sap/sapsecuritypatchday

Check your stack JSON