SAP Security Patch Day – September 2025

HotNews

We see four HotNews notes released on this month’s SAP Security Patch Day:

Note 3634501 addresses another deserialization vulnerability in the SAP NetWeaver Java stack. This recalls July’s patch cycle, when several similar issues were disclosed. In this case, the vulnerability specifically concerns the P4 protocol. Since this protocol is not widely known, let’s briefly explain: the P4 protocol is a proprietary SAP protocol used mainly by certain Java system clients. For example, the Integration Builder applications for SAP Process Integration rely on it. Unlike HTTP (used by browsers or standard tools), these applications connect via the P4 protocol through a separate port.
Further details:

• SAP Help: Security Guide for Connectivity with the AS Java
• SAP Help: Transport Layer Security

According to the note, this protocol is vulnerable and can be exploited to execute arbitrary OS commands — all without authentication, which justifies its maximum CVSS score of 10. Patching is absolutely required. However, also consider the recommended workaround: communication over the P4 protocol is often needed by only a handful of users, or not at all. Access should be restricted at the ICM level (as the note suggests) or otherwise, and such restrictions could be made permanent.

Note 3643865 highlights a vulnerability in the Deploy Web Service on the SAP NetWeaver Java stack. It allows arbitrary file uploads to the server, leading to potential full system compromise. Any non-administrative user can exploit this. Since no workaround exists, patching is the only solution.

Note 3302162 is an older HotNews note (from 2023) that has been re-released with updated Correction Instructions. If your system matches the relevant version level, ensure you re-check and apply the updated fixes.

Note 3627373 is relevant only for ABAP systems running on IBM-i where multiple system instances (SIDs) share the same LPAR. Although the description of the vulnerability is somewhat vague, it appears to allow access across systems in this configuration. If your environment matches these conditions, update the SAP kernel as outlined in the note.

High-Priority Notes

While High-priority notes are a step below HotNews in criticality, they are still important. Four notes fall into this category:

Note 3642961 discloses a vulnerability in SAP Business One, a component not frequently patched for security issues.

Notes 3635475 and 3633002 cover nearly identical vulnerabilities where database table content can be deleted in S/4 CORE and DMIS components.

Note 3581811 (originally released in April) has updated Correction Instructions for the ST-PI component.

None of these notes provides workarounds — patching is mandatory.

Medium- and Low-Priority Notes – External Libraries

This Patch Tuesday, 16 notes fall into the Medium or Low categories. Highlights include:

Note 3620264: vulnerability in the Spring Security component affecting SAP Commerce Cloud and SAP Datahub. Resolution: update the relevant components and redeploy.

Note 3611420: vulnerability in a JSON parser.

Note 3525295: information disclosure due to an outdated OpenSSL version used by Adobe Document Service on SAP NetWeaver Java stacks.

Note 3632154: vulnerability involving outdated Jetty classes.

All of the above issues arise from third-party libraries bundled with SAP software!

SecurityBridge Findings

At SecurityBridge, we don’t just deliver a comprehensive SAP security platform — we actively contribute research to the SAP security community. Our continuous research often uncovers new vulnerabilities, which we disclose responsibly and resolve in close collaboration with SAP.

For this month’s release, we are proud to highlight our latest discovery:

Medium: Note 3623504 [CVE-2025-42918] — Missing authorization check in SAP NetWeaver Application Server for ABAP (Background Processing).