SAP Security Notes: December 2025 Patch Day

Two HotNews vulnerabilities in SAP Solution Manager and SAP jConnect SDK for ASE patched in collaboration with the Onapsis Research Labs

Highlights of December SAP Security Notes analysis include:

• December Summary – Seventeen new and updated SAP security patches released, including four HotNews Notes and five High Priority Notes
• SAP Solution Manager – Critical Code Injection vulnerability allows full compromise of the system
• Onapsis Research Labs Contribution – Our team supported SAP in patching five vulnerabilities, covered by two HotNews and two High Priority SAP Security Notes

SAP has published seventeen new and updated SAP Security Notes in its December Patch Day, including four HotNews Notes and five High Priority Notes. Four of the fourteen new SAP Security Notes were published in collaboration with the Onapsis Research Labs.

The HotNews Notes in Detail

The Onapsis Research Labs (ORL) supported SAP in patching two critical vulnerabilities in SAP Solution Manager and in SAP jConnect – SDK for ASE.

SAP Security Note #3685270, tagged with a CVSS score of 9.9, patches a Code Injection vulnerability in SAP Solution Manager. The ORL team identified a remote-enabled function module that allows an authenticated attacker to inject arbitrary code, leading to high impact on confidentiality, integrity and availability of the system. The vulnerability is patched by adding appropriate input sanitization to the affected function module. Given the central role of SAP Solution Manager in the SAP system landscape, we strongly recommend a timely patch.

The second HotNews Note that was released in collaboration with the ORL team is SAP Security Note #3685286, tagged with a CVSS score of 9.1. Our team was able to exploit a deserialization vulnerability in the SAP jConnect SDK for Sybase Adaptive Server Enterprise(ASE) to launch remote code execution by providing specially crafted input to the component. A successful exploit requires high privileges, preventing the vulnerability from being tagged with a CVSS score of 10.0.

SAP HotNews Note #3668705, tagged with a CVSS score of 9.9, was initially released on SAP’s November Patch Day and patches a Code Injection vulnerability in SAP Solution Manager. The note was updated with additional correction instructions.

The third new HotNews Note of SAP’s December Patch Day affects SAP Commerce Cloud customers. SAP Commerce Cloud uses a version of Apache Tomcat that is vulnerable to CVE-2025-55754 and CVE-2025-55752. SAP Security Note #3683579, tagged with a CVSS score of 9.6, provides corrections that include a patched version of Apache Tomcat. Keeping unpatched, customers pose the application’s confidentiality, integrity, and availability at high risk.

The High Priority Notes in Detail

The Onapsis Research Labs could also contribute to patching three High Priority vulnerabilities that were patched by SAP with two Security Notes.

SAP Security Note #3684682, tagged with a CVSS score of 8.2, disables some vulnerable interfaces in SAP Web Dispatcher and SAP Internet Communication Manager(ICM) that were only intended for testing purposes. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. As a quick workaround, customers can remove the generic profile parameters that expose the interfaces from the default and instance profiles.

SAP Security Note #3677544, tagged with a CVSS score of 7.5, patches Memory Corruption vulnerabilities in SAP Web Dispatcher, SAP Internet Communication Manager(ICM) and SAP Content Server. The ORL team detected that an unauthenticated user can exploit logical errors to cause memory corruption leading to a high negative impact on the application’s availability.

High Priority Note #3640185 is tagged with a CVSS score of 7.9 and patches a Denial of Service vulnerability in the SAP NetWeaver remote service for XCelsius. The patch removes the affected service since XCelsius support ended on December 31, 2020. If the service is not removed, an attacker with network access and high privileges can execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls.

SAP Security Note #3650226, tagged with a CVSS score of 7.5, addresses a Denial of Service vulnerability in SAP Business Objects. A third-party component used by the application allows an unauthenticated attacker to flood the service due to improper request and resource handling, preventing legitimate users from accessing it. The patch contains an updated version of the affected third-party component that is now protected against uncontrolled resource consumption.

SAP Security Note #3672151, tagged with a CVSS score of 7.1, patches a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud. The vulnerability allows an authenticated attacker with authorization limited to a single company code to read sensitive data and post or modify documents across all company codes.

Summary & Conclusions

With seventeen SAP Security Notes, including four HotNews Note and five High Priority Notes, SAP’s December Patch Day is another busy one. Two HotNews and two High Priority Notes were released in collaboration with the Onapsis Research Labs and thus, our team could once more significantly contribute to making SAP applications more secure.

As always, the Onapsis Research Labs is already updating The Onapsis Platform to incorporate the newly published vulnerabilities into the product so that our customers can protect their businesses.

For more information about the latest SAP security issues and our continuous efforts to share knowledge with the security community, subscribe to our monthly Defender’s Monthly Newsletter.