A vital safety vulnerability impacting SAP S/4HANA, an Enterprise Useful resource Planning (ERP) software program, has come beneath energetic exploitation within the wild.
The command injection vulnerability, tracked as CVE-2025-42957 (CVSS rating: 9.9), was fastened by SAP as a part of its month-to-month updates final month.
“SAP S/4HANA permits an attacker with person privileges to use a vulnerability within the operate module uncovered by way of RFC,” in response to an outline of the flaw within the NIST Nationwide Vulnerability Database (NVD). “This flaw allows the injection of arbitrary ABAP code into the system, bypassing important authorization checks.
Profitable exploration of the defect might end in a full system compromise of the SAP setting, subverting the confidentiality, integrity, and availability of the system. Briefly, it will probably allow attackers to change the SAP database, create superuser accounts with SAP_ALL privileges, obtain password hashes, and alter enterprise processes.
SecurityBridge Risk Analysis Labs, in an alert issued Thursday, mentioned it has noticed energetic exploitation of the flaw, stating the difficulty impacts each on-premise and Personal Cloud editions.
“Exploitation requires entry solely to a low-privileged person to totally compromise an SAP system,” the corporate mentioned. “An entire system compromise with minimal effort required, the place profitable exploitation can simply result in fraud, information theft, espionage, or the set up of ransomware.”
It additionally famous that whereas widespread exploitation has not but been detected, menace actors possess the information to make use of it, and that reverse engineering the patch to create an exploit is “comparatively simple.”
Consequently, organizations are suggested to use the patches as quickly as potential, monitor logs for suspicious RFC calls or new admin customers, and guarantee applicable segmentation and backups are in place.
“Take into account implementing SAP UCON to limit RFC utilization and overview and limit entry to authorization object S_DMIS exercise 02,” it additionally mentioned.
