SAP Security Patch Day – December 2025

HotNews

Let’s start with HotNews, the highest-priority category. There are four notes in total — three newly released today and one update.

Remember our previous HotNews find 3668705? It was released last month and has been re-released with updated correction instructions. The risk profile is identical — authenticated low‑privilege attackers can inject code via a remote‑enabled function — so apply the refreshed instructions immediately if required. (CVSS 9.9).

Which brings us to note 3685270, which is a vulnerability that is closely linked. When note 3668705 has been implemented, the system is still vulnerable because of missing input‑sanitation that can lead to a complete system takeover. SAP fixed this by adding strict input sanitization that rejects most non‑alphanumeric characters; implementation is via Correction Instructions/Support Packages and there’s no workaround. (CVSS 9.9).

Note 3683579 describes a vulnerability for SAP Commerce Cloud regarding Apache Tomcat. SAP Commerce Cloud shipped a Tomcat build prone to console manipulation and relative path traversal. SAP addresses this by upgrading Tomcat; customers must move to the newer versions mentioned, then rebuild and redeploy. There’s no workaround and the score reflects broad C/I/A impact (CVSS 9.6).

The vulnerability of note 3685286 concerns SAP jConnect (SDK for ASE). Under certain conditions, a highly privileged user can trigger unsafe deserialization that enables remote code execution. SAP disables the vulnerable (de)serialization path and restricts a connection property; customers should upgrade (CVSS 9.1)!

High-Priority Notes

We only have 5 High-priority notes this month which have all been newly released. Although these are 1 category below HotNews, they are still important.

Every once in while, a vulnerability comes along that is the result of ‘testing’ functionality that should have been deleted but made its way to production releases. Note 3684682 describes such a vulnerability on the SAP ICM, having an impact on several components, like Web Dispatcher, ABAP, Java, HANA. If the icm/HTTP/icm_test_<x> parameter is present in profiles, internal testing endpoints become reachable, exposing diagnostics and enabling crafted requests. The remediation is configuration‑only: remove all such parameters from DEFAULT and instance profiles and restart. This is a manual activity, see the note’s instructions for the affected releases. (CVSS 8.2).

Note 3640185 concerns NetWeaver BI Java (Xcelsius remote service) which has been long deprecated. It needs to be undeployed (using good-old telnet…) and patched (CVSS 7.9).

Another ICM related issue – that also affects SAP Content Server – is described in note 3677544. Logic errors in kernel memory handling allow unauthenticated network attacks that impact availability. Fixes arrive via kernel and component patches. Deploy the archives and make sure to restart services where needed. See note 3636955 for HANA XSA. The note includes detailed patching guidance and there’s no workaround. (CVSS 7.5).

Note 3650226 describes how a DoS attack is possible due to improper request/resource handling. An unauthenticated attacker can flood the service, causing long delays or outages. SAP updated impacted third‑party components and hardened resource controls; apply the listed Support Packages and Patches. (CVSS 7.5).

A missing authorization check lets a user restricted to one company code read and even post across all company codes on S/4HANA Private Cloud (FI‑GL), note 3672151. Apply the corrections or apply the workaround as found in note 3673002. Patching is the recommended path though. (CVSS 7.1).

 Medium- and Low-Priority Notes

This Patch Tuesday, 8 notes fall into the Medium category of which 2 have been updated. See below for some highlights and for a full breakdown, scroll to the end of this post.

Note 3676970 is about SAPUI5/OpenUI5 (markdown‑it DoS). An outdated markdown‑it library could hang the rendering thread with malformed input, spiking CPU and freezing UI sessions. Update to the minimum fixed SAPUI5 patch levels mentioned in the note. See note 2419950 for installation instructions.