SecurityBridge Research Labs Update - Q2 2025
Chapters
Share Article
Let's Talk SAP Security
Have questions about SAP Security? We’re here to help. Contact Us
Introduction
The SecurityBridge Research Labs focuses on advancing SAP security through continuous research and
innovation. SecurityBridge has integrated SAP security research into its operations, aiming to enhance security, identify vulnerabilities, and contribute to the safety of the SAP ecosystem. The lab publishes findings, collaborates with external experts, supports product development, and contributes to open-source projects.
Our lab is dedicated to vulnerability detection, fortifying internal security, and employee skill development.
With a research strategy based on ethical compliance, strong strategic partnerships, and continuous training to ensure we deliver the most cutting-edge SAP security solutions.
SAP Security Findings
In the second quarter of 2025, SAP patched a total of 3 vulnerabilities discovered by the SecurityBridge
Research Labs. The researchers were acknowledged and credited in the following SAP Security Notes:
A breakdown of the severity and the CVSS score is provided below:
As we respect a grace period of 3 months to allow customers to implement the patches, specific details about the vulnerabilities found cannot be shared yet. However, for some of the above-released patches, SecurityBridge has shipped product updates to detect execution of vulnerable ABAP programs.
How We Found the Vulnerabilities
All vulnerabilities were discovered by indexing and analysing large amounts of ABAP code with custom-built specialized tooling. This process includes testing for practical exploitation and making sure no false positives are reported.
What is the risk?
All 3 discovered vulnerabilities have a medium risk rating and cannot be exploited without authentication.
However, the password hash disclosure vulnerability (SAP Security note 3596033) and the operating system command execution vulnerability (SAP Security note 3571093) can be leveraged to escalate privileges to higher authorizations. This may potentially result in a full system compromise, including unauthorized access to all SAP data.
How to protect yourself
For customers to stay protected against these 3 vulnerabilities, and others, it is imperative to apply the
patches as soon as possible and consider proper testing. The SecurityBridge Research Labs is tightly integrated with product development, leading to continuous updates, e.g., in the area of the SecurityBridge Patch Management module.
About SecurityBridge
SecurityBridge is the leading provider of a comprehensive, SAP-native cybersecurity platform. Trusted by
organizations worldwide to safeguard their most critical business systems. Our platform seamlessly integrates real-time threat monitoring, vulnerability management, and compliance capabilities directly into the SAP environment, empowering organizations to protect their data’s integrity, confidentiality, and availability with minimal manual effort. With a proven track record, including a stellar customer success rating and over 8,000 SAP systems secured globally. SecurityBridge stands out for its ability to accurately provide a 360° view of the SAP security posture, ease of use, rapid implementation, and transparent licensing. We are committed to innovation, transparency, and customer-centricity, ensuring businesses can confidently navigate the evolving landscape of SAP security threats.
