A essential safety vulnerability impacting SAP S/4HANA, an Enterprise Useful resource Planning (ERP) software program, has come underneath lively exploitation within the wild.
The command injection vulnerability, tracked as CVE-2025-42957 (CVSS rating: 9.9), was fastened by SAP as a part of its month-to-month updates final month.
“SAP S/4HANA permits an attacker with consumer privileges to take advantage of a vulnerability within the operate module uncovered by way of RFC,” in response to an outline of the flaw within the NIST Nationwide Vulnerability Database (NVD). “This flaw permits the injection of arbitrary ABAP code into the system, bypassing important authorization checks.
Profitable exploration of the defect may end in a full system compromise of the SAP atmosphere, subverting the confidentiality, integrity, and availability of the system. Briefly, it may possibly allow attackers to switch the SAP database, create superuser accounts with SAP_ALL privileges, obtain password hashes, and alter enterprise processes.
SecurityBridge Risk Analysis Labs, in an alert issued Thursday, mentioned it has noticed lively exploitation of the flaw, stating the difficulty impacts each on-premise and Personal Cloud editions.
“Exploitation requires entry solely to a low-privileged consumer to totally compromise an SAP system,” the corporate mentioned. “An entire system compromise with minimal effort required, the place profitable exploitation can simply result in fraud, knowledge theft, espionage, or the set up of ransomware.”
It additionally famous that whereas widespread exploitation has not but been detected, menace actors possess the information to make use of it, and that reverse engineering the patch to create an exploit is “comparatively straightforward.”
In consequence, organizations are suggested to use the patches as quickly as potential, monitor logs for suspicious RFC calls or new admin customers, and guarantee applicable segmentation and backups are in place.
“Contemplate implementing SAP UCON to limit RFC utilization and evaluate and limit entry to authorization object S_DMIS exercise 02,” it additionally mentioned.
