SAP Security Patch Day – November 2025

HotNews

Let’s start with HotNews, the highest-priority category. There are four notes in total — two newly released today and two updates.

Note 3666261 has been newly released and carries the highest possible score (CVSS score 10). It concerns the SQL Anywhere Monitor tool, an administration tool used for various components like SQL Anwhere databases, MobiLink server etc. The Monitor holds hard-coded credentials resuling in the HotNews priority. The solution is to apply the fix or apply a workaround by deleting the Monitor entirely. Note that the use of the Monitor has been discontinued, and the SQL Anywhere Cockpit should be used instead. See SQL Anywhere Cockpit.

Like last month, note 3660659 is again listed. The update concerns various updates on the workaround and additional hardening of SAP NetWeaver AS Java systems. Make sure to double check if you applied this note previously!

Note 3668705 describes how a remote-enabled function module can be misused to insert malicious code, resulting in full control of the system. There is no workaround, so patching is the only solution!

Note 3647332 was initially released last month and has been updated with additional version validities. Make sure to double check if your landscape requires this patch now for SAP SRM.

High-Priority Notes

We only have 2 High-priority notes this month. Although these are 1 category below HotNews, they are still important.

Note 3633049 describes a vulnerability in SAP CommonCryptoLib, used for various encryption tasks in SAP landscapes. A malicious actor can cause an application to crash. The solution is simple: apply the patch. However, CommonCryptoLib is used in various components which makes it more difficult to identity the complete patching scope.  Make sure to check the components reference by note 3628110 to identify the components you need to update.

Note 3664466 has been released last month and has slightly updated.

Medium- and Low-Priority Notes

This Patch Tuesday, 19 notes fall into the Medium or Low categories. These are a mix of new and updated notes. See below for some highlights and for a full breakdown, scroll to the end of this post.

SAP Business Connector anyone?

Integration specialists that have been around for some time, may remember the SAP Business Connector as one of the earliest products for SAP integration scenarios. While many think that the Business Connector is since long dead and buried, the 4.8 version is actually still supported! In this month’s patch cycle, we find no less than 4 security notes: Note 3665900, 3666038, 3662000 and 3665907. It looks like someone in the security community has been busy with a special interest for the Business Connector…