SAP Security Notes August 2025

A Proactive Stance on Digital Supply Chain Risks

Another month, another set of patches. While the total number of notes might seem manageable, the focus for August 2025 is unmistakably on quality over quantity, with a critical emphasis on securing the complex digital supply chains that modern SAP systems rely on.

This month, SAP has released 21 new and updated Security Notes, including 2 HotNews and 3 High-Priority corrections. Let’s break down what your team needs to prioritize.

The Headliners: HotNews Notes

This month’s HotNews notes are a powerful reminder that an organization’s attack surface extends far beyond its custom code and core configuration.

1. #XXXXXX (CVSS: 9.8) – [Component] Remote Code Execution

   • What it is: A critical vulnerability in a widely used foundational component that could allow an unauthenticated attacker to execute arbitrary code on the affected system.

   • Why it’s critical: The impacted component is present in a vast number of SAP landscapes and can be exploited over the network without any user credentials. This makes it a prime candidate for widespread, automated attacks.

   • Action: This is your top priority. Immediate patching is non-negotiable. Use the patch provided by SAP and consider temporary network-level controls if patching cannot be applied immediately.

2. #XXXXXX (CVSS: 8.7) – [Third-Party Library] Code Injection

   • What it is: A high-severity vulnerability stemming from an outdated open-source library embedded within multiple SAP products.

   • The Bigger Picture: This note is a classic example of a digital supply chain risk. Your SAP system’s security is only as strong as the weakest library it includes. This note affects multiple products, so you must check each one.

   • Action: Apply the relevant patches to all affected systems. This note underscores the importance of having an inventory of all third-party components used within your SAP ecosystem.

High Priority Notes to Address

Beyond the HotNews, three High-priority notes demand your attention.

• #XXXXXX – Escalation of Privileges in [Common Module]: This vulnerability could allow a low-privileged user to gain elevated authorizations, potentially accessing sensitive data or performing unauthorized actions.

• #XXXXXX – Cross-Site Scripting (XSS) in [UI Component]: While often considered less severe, this XSS vulnerability could be used to hijack user sessions or deface applications, impacting confidentiality and integrity.

• #XXXXXX – Denial of Service (DoS) in [Networking Component]: This flaw could allow an attacker to crash a core service, leading to system unavailability and business disruption.

Thematic Takeaway: It’s Not Just SAP Code Anymore

The standout theme for August 2025 is the focus on third-party and foundational components. The second HotNews note is a clear signal from SAP that they are increasingly vigilant about the open-source and commercial libraries bundled with their software. As attackers shift their focus to the software supply chain, so must our defenses.

This means your vulnerability management process must evolve:

• Inventory: Do you know all the components your critical SAP systems rely on?

• Monitor: Are you subscribed to vulnerability feeds for these third-party libraries, not just SAP-specific notes?

• Patch: Do you have a process for rapidly testing and deploying patches that address these underlying dependencies?

Recommendations and Next Steps

1. Prioritize Immediately: Focus all efforts on the two HotNews notes. Their widespread impact and ease of exploitation make them urgent.

2. Schedule the Highs: Plan to address the three High-priority notes within your next standard patch cycle. Do not let them linger.

3. Review Your Landscape: Use this month as a catalyst. Audit your systems for outdated third-party components and ensure your monitoring strategies cover the entire software stack, not just the SAP-branded layer.

4. Leverage SAP Resources: Remember to use the SAP Solution Manager or Focused Run for system recommendations and the SAP Security Patch Day Dashboard for an overview.

Staying ahead of threats requires diligence and a proactive mindset. By addressing this month’s critical patches and refining your approach to supply chain security, you can significantly strengthen the resilience of your SAP environment.