SAP warns of high-severity vulnerabilities in multiple products

As hackers exploit a high-severity vulnerability in SAP’s flagship Enterprise Resource Planning software product, the software maker is warning users of more than two dozen newly detected vulnerabilities in its other widely used products, including a security flaw with a maximum-severity rating of 10.

SAP on Tuesday said the highest-severity vulnerability—with a rating of 10 out of a possible 10—was found in NetWeaver, a platform that serves as the technical foundation for many of the company’s other enterprise applications. The vulnerability, tracked as CVE-2025-42944, makes it possible for unauthenticated attackers to execute commands by submitting malicious payloads to an open port.

The maximum-severity threat stems from a deserialization vulnerability. Serialization is a coding process that translates data structures and object states into formats that can be stored or transmitted and then reconstructed later. Deserialization is the process in reverse.

In Tuesday’s disclosure, SAP revealed three other high-severity NetWeaver vulnerabilities, with ratings of 9.9, 9.6, and 9.1.

Word of the newly documented vulnerabilities comes five days after security firm SecurityBridge reported that a separate high-severity vulnerability SAP patched last month was under active exploitation in the wild. That vulnerability, tracked as CVE-2025-42957 and carrying a severity rating of 9.9, resides in the SAP S/4HANA an ERP (Enterprise Resource Planning) software suite developed for managing large organizations’ complex business processes, including those for finance, accounting, and HR.