Vulnerabilities in SAP Products · CIAD-2025-0051
CERT-In advisory CIAD-2025-0051 · 12 Dec 2025
Official title
CIAD-2025-0051 : Multiple vulnerabilities in SAP Products
Official record
Open source pageSummary
Check the official recordWhat changed
CERT-In reports multiple high-severity vulnerabilities in various SAP products. These flaws allow attackers to disclose sensitive information, gain elevated privileges, execute arbitrary code, or cause denial-of-service conditions. Attackers also perform Cross-Site Scripting and Server-Side Request Forgery on targeted systems. Affected parties include SAP system administrators, security teams, IT infrastructure teams, and application developers. Users must apply the security updates provided by the vendor to mitigate these risks. The vendor provides specific instructions and patches through the official SAP support portal.
What you must do
- Apply the security updates provided by the vendor.
Key dates
- Original Issue Date
- 12 Dec 2025
Who is affected
Document text
CERT-In Advisory CIAD-2025-0051
Multiple vulnerabilities in SAP Products
Original Issue Date: December 12, 2025
Severity Rating: High
Software Affected
SAP Solution Manager
SAP Commerce Cloud
SAP jConnect - SDK for ASE
SAP Web Dispatcher & Internet Communication Manager (ICM)Version
SAP NetWeaver
SAP Business Objects
SAP Web Dispatcher, Internet Communication Manager & SAP Content Server
SAP S/4 HANA Private Cloud (Financials General Ledger)
SAP NetWeaver Internet Communication Framework
Application Server ABAP
SAP NetWeaver Enterprise Portal
SAPUI5 framework (Markdown-it component)
SAP Enterprise Search for ABAP
SAP BusinessObjects Business Intelligence Platform
Overview
Multiple vulnerabilities have been reported, which could be exploited by an attacker to disclose sensitive information, gain elevated privileges, execute arbitrary code, denial-of-service condition, perform Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) on the targeted system.
Target Audience:
SAP system administrators, SAP security teams, IT infrastructure teams managing SAP landscape and Application developers using affected SAP.
Risk Assessment:
Potential for system compromise, data exposure, unauthorized access, privilege abuse, service disruption, arbitrary file upload.
Impact Assessment:
High risk of data breach, execution of arbitrary code, full system compromise, unavailability, security control bypass, and operational disruption.
Description
Multiple vulnerabilities have been reported in SAP products; details of which are provided below:
Solution
Apply appropriate updates as mentioned by the vendor:
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2025.html
Vendor Information
SAP
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2025.html
References
SAP
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2025.html
CVE Name
CVE-2025-55754
CVE-2025-42928
CVE-2025-42878
CVE-2025-42874
CVE-2025-48976
CVE-2025-42877
CVE-2025-42876
CVE-2025-42875
CVE-2025-42880
CVE-2025-42904
CVE-2025-42872
CVE-2025-42873
CVE-2025-42891
CVE-2025-42896
Source details
- Source
- Indian Computer Emergency Response Team
- Type
- advisory
- Published by source
- 12 Dec 2025
- Document number
- CIAD-2025-0051
- Issuing division
- CERT-In
- Coverage area
- cybersecurity