What’s Vulnerable › Vulnerabilities

CVE-2025-42876: Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger)

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-09 · updated 2026-10-07
• Weakness: CWE-405

Description

Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all company codes. Successful exploitation could result in a high impact to confidentiality and a low impact to integrity, while availability remains unaffected.

Affected products

• SAP_SE SAP S/4 HANA Private Cloud (Financials General Ledger): S4CORE 104, 105, 106, 107, 108, 109

References

• https://me.sap.com/notes/3672151
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42876 or the next vulnerability affects your stack