SAP Security Patch Day, September 2025: the CVEs
Filter
SAP Security Patch Day September 2025: the CVEs SAP published on 9 September 2025, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Aug 2025, Jul 2025, Jun 2025, May 2025, Apr 2025, Mar 2025, Feb 2025, Jan 2025, Dec 2024, Nov 2024, Oct 2024, Sep 2024. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday
- 9.1CVE-2025-42958EPSS 0.7%
Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privile…
- 10.0CVE-2025-42944EPSS 3.0%
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects cou…
- 9.9CVE-2025-42922EPSS 0.7%
SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and …