Loading story…
A critical code injection vulnerability, tracked as CVE-2025-42880, has been identified in SAP Solution Manager. The flaw arises from insufficient input sanitation, allowing authenticated attackers to inject malicious code via remote-enabled function modules. Successful exploitation could grant attackers full control over the affected system, severely impacting confidentiality, integrity, and availability. The vulnerability is remotely exploitable and has been assigned a CVSS score of 9.9, indicating its high severity. SAP has released a final patch to address this issue, emphasizing the risk of full system compromise if left unremediated.
Security researchers and SAP have highlighted the urgency of applying the patch, as exploitation could lead to complete takeover of SAP Solution Manager environments. Organizations using SAP Solution Manager are strongly advised to review their deployments and apply the latest security updates to mitigate the risk. No specific affected product versions have been listed, but the vulnerability is confirmed to be present in the platform. The disclosure underscores the importance of prompt patch management in enterprise SAP environments to prevent potential attacks leveraging this critical flaw.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-42880 was publicly disclosed as a critical SAP Solution Manager vulnerability with a CVSS score of 9.9. The flaw stems from missing input sanitation and could allow an authenticated attacker to inject malicious code through remote-enabled function modules, potentially leading to full system compromise.
SAP addressed CVE-2025-42880, a critical code injection flaw in SAP Solution Manager, in its December 2025 security update. The fix was described as part of SAP's final patch cycle of 2025, and affected organizations were urged to apply it immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvedetails.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP has released security updates addressing 13 newly identified vulnerabilities across its product suite, with particular focus on a maximum-severity flaw in SAP NetWeaver AS Java. The most critical vulnerability, tracked as CVE-2025-42944 and assigned a CVSS score of 10.0, is an insecure deserialization issue that allows unauthenticated attackers to execute arbitrary operating system commands. This flaw can be exploited via the RMI-P4 module by submitting a malicious payload to an open port, potentially compromising the confidentiality, integrity, and availability of affected systems. SAP initially addressed this vulnerability in a previous update, but the latest patch introduces additional hardening measures, including a JVM-wide filter (jdk.serialFilter) to block the deserialization of dangerous classes. The list of classes and packages to be filtered was developed in collaboration with the Onapsis Research Labs and is divided into mandatory and optional sections to maximize protection. In addition to CVE-2025-42944, SAP has patched a directory traversal vulnerability in SAP Print Service (CVE-2025-42937, CVSS 9.8), which could allow unauthenticated attackers to overwrite system files by exploiting insufficient path validation. Another critical issue, CVE-2025-42910 (CVSS 9.0), affects SAP Supplier Relationship Management and involves unrestricted file upload, enabling authenticated attackers to upload arbitrary files, including potentially malicious executables. These vulnerabilities collectively pose significant risks to enterprise environments running SAP solutions, as successful exploitation could lead to system compromise, data loss, or service disruption. SAP has stated that there is currently no evidence of these vulnerabilities being exploited in the wild. Security experts and SAP have emphasized the importance of promptly applying the latest patches to mitigate the risk of exploitation. The additional hardening for the deserialization flaw is particularly notable, as it provides a more robust defense against a class of attacks that have historically been difficult to fully remediate. Organizations are advised to review their SAP deployments, ensure all relevant updates are applied, and follow SAP’s guidance on blocking risky deserialization classes. The disclosure and remediation of these vulnerabilities highlight the ongoing challenges in securing complex enterprise software platforms. SAP’s collaboration with security researchers and the implementation of layered defenses demonstrate a proactive approach to addressing critical security issues. Enterprises relying on SAP NetWeaver and related products should prioritize these updates as part of their regular patch management processes. Failure to address these vulnerabilities could leave systems exposed to remote attacks that require no authentication, significantly increasing the risk profile for affected organizations. The security community continues to monitor for any signs of exploitation and urges vigilance in maintaining up-to-date SAP environments.
Jun 29, 2026
Fortinet, Ivanti, and SAP have released urgent security updates to address multiple critical vulnerabilities in their respective products, with potential impacts including authentication bypass, remote code execution, and stored cross-site scripting. Fortinet's advisories detail two flaws (CVE-2025-59718 and CVE-2025-59719, CVSS 9.8) in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, which could allow unauthenticated attackers to bypass FortiCloud SSO login authentication via crafted SAML messages if the feature is enabled. Ivanti has patched four vulnerabilities in Endpoint Manager, including a critical stored XSS flaw (CVE-2025-10573, CVSS 9.6) that could let remote attackers execute arbitrary JavaScript in administrator sessions. Organizations are advised to disable FortiCloud SSO login as a temporary mitigation and apply all available updates promptly. SAP's December security updates address 14 vulnerabilities, including three critical flaws. The most severe, CVE-2025-42880 (CVSS 9.9), is a code injection vulnerability in SAP Solution Manager that could grant attackers full system control. Additional critical issues include CVE-2025-55754 (CVSS 9.6), affecting SAP Commerce Cloud due to Apache Tomcat vulnerabilities, and CVE-2025-42928 (CVSS 9.1), a deserialization flaw in SAP jConnect that could enable remote code execution. SAP's bulletin also includes fixes for several high- and medium-severity vulnerabilities across its product suite, underscoring the need for immediate patching to mitigate exploitation risks.
Jun 29, 2026
SAP’s February 2026 Security Patch Day shipped **26 new SAP Security Notes** (plus one updated note) and urged customers to prioritize patching across core SAP workloads. The most severe issue is **CVE-2026-0488** (CVSS **9.9**), a **code-injection** vulnerability in the **Scripting Editor** of **SAP CRM** and **SAP S/4HANA** (SAP Note `3697099`), which can be exploited by an **authenticated, low-privilege user** to execute arbitrary code/unauthorized functionality with broad impact across the environment. The bulletin also addressed additional critical and high-severity risks, including **CVE-2026-0509** (CVSS **9.6**; SAP Note `3674774`), a **missing authorization check** in **SAP NetWeaver Application Server ABAP / ABAP Platform** that can allow low-privilege users to perform unauthorized actions (including background RFC activity). Other highlighted items include **CVE-2026-23687** (XML Signature Wrapping) affecting trust decisions in XML-based flows, and **CVE-2026-23689** in **SAP Supply Chain Management**, an **uncontrolled resource consumption** issue that can be abused to cause **denial of service** by exhausting system resources via repeated calls with oversized parameters.
Jun 29, 2026