SAP S/4HANA Critical Vulnerability CVE-2025-42957 Exploited in the Wild - The Hacker News

SAP S/4HANA Critical Vulnerability CVE-2025-42957 Exploited in the Wild Ravie LakshmananSep 05, 2025Vulnerability / Enterprise Security A critical security vulnerability impacting SAP S/4HANA, an Enterprise Resource Planning (ERP) software, has come under active exploitation in the wild. The command injection vulnerability, tracked as CVE-2025-42957 (CVSS score: 9.9), was fixed by SAP as part of its monthly updates last month. "SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC," according to a description of the flaw in the NIST National Vulnerability Database (NVD). "This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. Successful exploration of the defect could result in a full system compromise of the SAP environment, subverting the confidentiality, integrity, and availability of the system. In short, it can permit attackers to modify the SAP database, create superuser accounts with SAP_ALL privileges, download password hashes, and alter business processes. SecurityBridge Threat Research Labs, in an alert issued Thursday, said it has observed active exploitation of the flaw, stating the issue impacts both on-premise and Private Cloud editions. "Exploitation requires access only to a low-privileged user to fully compromise an SAP system," the company said. "A complete system compromise with minimal effort required, where successful exploitation can easily lead to fraud, data theft, espionage, or the installation of ransomware." It also noted that while widespread exploitation has not yet been detected, threat actors possess the knowledge to use it, and that reverse engineering the patch to create an exploit is "relatively easy." As a result, organizations are advised to apply the patches as soon as possible, monitor logs for suspicious RFC calls or new admin users, and ensure appropriate segmentation and backups are in place. "Consider implementing SAP UCON to restrict RFC usage and review and restrict access to authorization object S_DMIS activity 02," it also said. Update Cybersecurity vendor Pathlock has also revealed it "detected outlier activity consistent with exploitation attempts of CVE-2025-42957," warning "any organization that has not yet applied SAP’s August 2025 security notes is at risk." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  cybersecurity, data breach, enterprise security, ERP Software, Patching, ransomware, SAP, Threat Intelligence, Vulnerability Trending News Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1 APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict ThreatsDay Bulletin: DDR5 Bot Scalping, Samsung TV Tracking, Reddit Privacy Fine and More Open-Source CyberStrikeAI Deployed in AI-Driven FortiGate Attacks Across 55 Countries ⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack and Vibe-Coded Malware Microsoft Reveals ClickFix Campaign Using Windows Terminal to Deploy Lumma Stealer Starkiller Phishing Suite Uses AitM Reverse Proxy to Bypass Multi-Factor Authentication New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel Google Confirms CVE-2026-21385 in Qualcomm Android Component Exploited ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket OpenAI Codex Security Scanned 1.2 Million Commits and Found 10,561 High-Severity Issues Load More ▼ Popular Resources 19,053 Confirmed Breaches in 2025 – Key Trends and Predictions for 2026 Read CYBER360 2026: From Zero Trust Limits to Data-Centric Security Paths Identity Controls Checklist: Find Missing Protections in Apps Self-Hosted WAF: Block SQLi, XSS, and Bots Before They Reach Your Apps