Remote Code Execution Vulnerability in SAP S/4HANA and SCM
CVE-2025-42967

9.9CRITICAL

Key Information:

Vendor

SAP
Status
SAP S/4hana And SAP Scm (characteristic Propagation)
Vendor
CVE Published:
8 July 2025

What is CVE-2025-42967?

A remote code execution vulnerability exists in the Characteristic Propagation feature of SAP S/4HANA and SAP SCM. This vulnerability enables an attacker with elevated privileges to execute arbitrary code in the SAP environment, potentially allowing them to take full control of the affected system. Such an attack can severely compromise the confidentiality, integrity, and availability of critical business applications, necessitating immediate attention and remediation to protect organizational assets.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

SAP S/4HANA and SAP SCM (Characteristic Propagation) SCMAPO 713

SAP S/4HANA and SAP SCM (Characteristic Propagation) 714

SAP S/4HANA and SAP SCM (Characteristic Propagation) S4CORE 102

References

https://me.sap.com/notes/3618955
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.