What’s Vulnerable › Vulnerabilities

CVE-2025-43008: Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal

• Severity: medium (CVSS 5.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-13 · updated 2026-06-17
• Weakness: CWE-862

Description

Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data of employees. There is no impact on integrity and availability.

Affected products

• SAP_SE SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal: S4HCMCPT 100, 101, SAP_HRCPT 600, 604, 608

References

• https://me.sap.com/notes/3585992
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-43008 or the next vulnerability affects your stack