Overview
SAP’s security patch day for May 2025 has seen the release of 18 OSS SAP security notes. Two notes have been classified as critical, five as high, and eleven as medium based on the CVSS v3.0 Rating.
Two notes have been released for:
- SAP NetWeaver
- SAP Service Parts Management
- SAP Supplier Relationship Management
Single notes have been released for:
- SAP S/4HANA Cloud Private Edition or on Premise
- SAP Business Objects Business Intelligence Platform
- SAP Landscape Transformation
- SAP PDCE
- SAP Gateway Client
- SAP S/4HANA (Private Cloud & On-Premise)
- SAP NetWeaver Application Server ABAP and ABAP Platform
- SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
- SAP Digital Manufacturing
- SAP Data Services Management Console
- SAP S4/HANA (OData meta-data property)
- SAP GUI for Windows
Vulnerabilities: May 2025 Highlights
[CVE-2024-39592] Missing Authorisation check in SAP PDCE (SAP Note 3483344)
Elements of PDCE do not perform necessary authorisation checks for an authenticated user, resulting in the escalation of privileges.
This allows an attacker to read sensitive information, causing high impact on the confidentiality of the application.
[CVE-2025-31329] Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (SAP Note 3577287)
SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the victim, sensitive information such as user credentials is exposed. These credentials may then be used to gain unauthorised access to local or adjacent systems. This results in high impact to Confidentiality, with no significant effect on Integrity or Availability.
About this Review
On the second Tuesday of each month, SAP release security updates to their software products. At Absoft, we analyse all of the released security updates and produce this security review, including sending bespoke recommendations for each of our managed service customers.
There is more information on how we handle SAP security updates, including information on SAP’s process, the CVE process and the CVSS base scores in our earlier article on addressing security vulnerabilities in SAP software.
