SAP Security Patch Day – August 2025

In this monthly cycle, 15 new notes have been released, 10 notes have been updated, or have been released earlier after the July patch cycle. Below, you’ll find the key highlights grouped by priority. For a full breakdown, scroll to the end of this post.

SecurityBridge Findings!

At SecurityBridge, we don’t just provide a comprehensive SAP security platform — we’re also deeply invested in ongoing research within the SAP security domain. This continuous commitment often leads to the discovery of new vulnerabilities, which we responsibly disclose and resolve in close collaboration with SAP.

For this month’s release, we’re proud to share our latest discoveries:

• HotNews: note 3633838 [CVE-2025-42950] Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
• HotNews: note 3627998 [CVE-2025-42957] Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
• High Priority: note 3614804 [CVE-2025-42946] Directory Traversal vulnerability in SAP S/4HANA (Bank Communication Management)

HotNews – SAP Landscape Transformation (SLT)

We see 4 HotNews mentioned this month. The first 2 notes (3633838 and 3627998) both have a CVSS score of 9.9. This is no coincidence: they both address the same issue, but for 2 different software components:

• DMIS: the data migration add-on that is required on certain ABAP systems to enable SLT.
• S4CORE: the core S/4 HANA component that has the required functionality already built in.

So, what is the vulnerability about? Not much detail to share right now, but the issue is that a function module can be exploited to gain full compromise of the system… There is no workaround; the solution is simple: patch! As confirmed by the accompanying FAQ notes (3638514 and 3630291), there is no downtime required and no impact for implementing the patch. So, the solution is simple: if you have the DMIS add-on installed or use S/4 HANA private cloud or on-premise, patch!

The other 2 HotNews notes are old acquaintances:

• Note 3581961: Additional support packages have been released for older versions than before. Check if these are applicable for your version.
• Note 3610892: A workaround has been provided by SAP that was not known before. See FAQ note 3628361 for the details, should you want to apply the workaround first.