What’s Vulnerable › Vulnerabilities
CVE-2025-42916: Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-09 · updated 2026-09-30
- Weakness: CWE-1287
Description
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality.
Affected products
- SAP_SE SAP S/4HANA (Private Cloud or On-Premise): S4CORE 102, 103, 104, 105, 106, 107 (+1)
References
Get alerted when CVE-2025-42916 or the next vulnerability affects your stack