Active exploit in the wild for SAP S/4HANA CVE-2025-42957

A critical code injection flaw in SAP S/4HANA that could allow attackers to take complete control of affected systems has been confirmed as actively exploited in the wild, Dutch cybersecurity authorities and independent researchers warned this week. The vulnerability, tracked as CVE-2025-42957 and rated 9.9 under the CVSS system, affects multiple S/4HANA releases in both private cloud and on-premises deployments and was patched by SAP in mid-August; organizations that have not applied the update remain at serious risk.

The Dutch National Cyber Security Center said its advisory was based on reporting by SecurityBridge Threat Research Labs, which said it verified real-world abuse of the flaw. SecurityBridge researchers also published a demonstration of the exploit. Although some agencies noted that no broadly available proof-of-concept has been published, SecurityBridge warned that reverse-engineering the patch to produce an exploit is relatively easy because ABAP source code is visible, leaving unpatched systems exposed.

According to vulnerability entries and researcher briefings, the flaw resides in a function module exposed via RFC that permits injection of arbitrary ABAP code...