What’s Vulnerable › Vulnerabilities

CVE-2025-42984: Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application)

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-10 · updated 2026-06-17
• Weakness: CWE-862

Description

SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user. Due to this, an attacker could execute the function import on the entity making it inaccessible for unrestricted user. This has low impact on confidentiality and availability of the application.

Affected products

• SAP_SE SAP S/4HANA (Manage Central Purchase Contract application): S4CORE 106, 107, 108

References

• https://me.sap.com/notes/3441087
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42984 or the next vulnerability affects your stack