This month, 22 security notes have either been newly released or updated since the previous release.

See below for the highlights per priority, and scroll to the end of this post for a complete overview.

HotNews

No fewer than four security notes have been listed with the highest ‘HotNews’ priority.

Security Note 3594142 has received significant attention since its release due to active exploitation in the wild. With a CVSS score of 10, this vulnerability should—obviously—be mitigated immediately.

Important note: In addition to Note 3594142, make sure to implement Note 3604119 as well. Although listed separately, this related vulnerability must also be addressed to ensure the Visual Composer component is properly secured. For more information, refer to our blog post: Critical SAP Zero-Day Vulnerability: CVE-2025-31324.

The other two HotNews notes were initially released last month but have since been updated. Refer to our previous blog post for background information.

• Note 3587115 includes updated correction instructions for more recent DMIS versions, so please verify applicability.
• Note 3581961 has only seen a minor update to its title. However, the change makes it clear that On-Premise systems are also affected. If you previously missed this, be sure to double-check.

High and medium priority 

Next up are the ‘High’ priority notes. While not as critical as the ‘HotNews’ items, these still describe serious security vulnerabilities—and should not be taken lightly.

The five notes in this category are relatively straightforward in terms of remediation. In most cases, it’s simply a matter of applying the available fixes.

• Note 3578900 outlines multiple vulnerabilities in the SRM_SERVER component—an uncommon target in recent advisories.
• Note 3483344 has been updated with correction instructions for the SEM-BW component, so be sure to check affected systems for applicability.

The remaining 13 notes are categorized as ‘Medium’ priority.

• Notes 2719724, 2491817, and 3585992 all address issues with authorization checks. Pay close attention to the manual activities required to ensure complete implementation.

SecurityBridge findings

At SecurityBridge, we not only provide a comprehensive SAP security solution for our customers, but we also conduct in-depth research on SAP security topics.

Through this ongoing research, we regularly discover vulnerabilities, which we then address in close collaboration with SAP. Following last month’s contributions, we’re proud to announce another finding: Note 3596033.