On November 11, 2025, SAP released 18 new Security Notes as part of its monthly Security Patch Day, along with 2 updates to previously released notes. This month’s release features 3 Critical-severity vulnerabilities with CVSS scores ranging from 9.9 to 10.0, 1 High-severity issue (CVSS 7.5), 14 Medium-severity problems (CVSS 4.3–6.9), and 2 Low-severity vulnerabilities (CVSS 2.7–3.1). The focus continues on code injection attacks, authorization control failures, and deserialization vulnerabilities, with one critical update enhancing October’s deserialization hardening measures for NetWeaver AS Java.
Key Highlights by Severity
Critical Priority (CVSS 10.0)
The first CVSS 10.0 vulnerability is a hard-coded credentials issue in SQL Anywhere Monitor Non-GUI that exposes resources to unintended users, enabling arbitrary code execution. The vulnerability stems from hard-coded passwords, usernames, and keys implemented to mitigate Adobe Flash dependency. SAP’s solution removes SQL Anywhere Monitor entirely, requiring migration to SQL Anywhere Cockpit for monitoring functionality.
The second represents an update to October’s critical deserialization security hardening note for SAP NetWeaver AS Java. This 40th version update adds extensive hardening suggestions for optional classes and packages, removes previous disclaimers, and references prerequisite note 3670067. The update demonstrates SAP’s continued refinement of defenses against deserialization threats.
Critical Priority (CVSS 9.9)
- A code injection vulnerability in SAP Solution Manager allows authenticated attackers with low privileges to insert malicious code when calling remote-enabled function modules. Missing input sanitation enables attackers to gain full control of the system, creating high impact on confidentiality, integrity, and availability. The fix introduces sanitization that rejects most non-alphanumeric characters.
High Priority (CVSS 7.5)
- A memory corruption vulnerability in SAP CommonCryptoLib results from insufficient boundary checks during pre-authentication parsing of ASN.1 data over the network. Attackers can send malicious data causing memory corruption and application crashes, with high availability impact.
Key Affected Components
SAP NetWeaver (Multiple Components): 5 security notes affecting AS Java, AS for ABAP, and Enterprise Portal, demonstrating continued infrastructure vulnerabilities across the core platform.
SAP Business Connector: 4 security notes addressing OS command injection, path traversal, open redirect, and reflected cross-site scripting vulnerabilities, highlighting significant security challenges in this middleware component requiring CoreFix 5 implementation.
SAP S/4HANA and SAP HANA: 4 security notes combined, with S/4HANA addressing missing authorization checks and HANA covering code injection and authentication gaps across database infrastructure components.
Other Enterprise Components: Notes spanning SQL Anywhere Monitor, Solution Manager, CommonCryptoLib, GUI for Windows, Business One SLD, Fiori, and Starter Solution, indicating broad vulnerability exposure across SAP’s product portfolio.
Notable Trends
Deserialization Hardening Continuation:
The critical update to October’s deserialization security note (now at version 40) demonstrates ongoing commitment to strengthening NetWeaver AS Java defenses through extensive optional class blocking.
Business Connector Security Deficit:
Four vulnerabilities affecting SAP Business Connector 4.8, all addressed through CoreFix 5, reveal concentrated security weaknesses spanning injection, traversal, redirect, and XSS attack vectors.
Code Injection Dominance:
Four notes address various injection vulnerabilities (code injection, OS command injection, SQL injection, JNDI injection), representing the most prevalent vulnerability class this month.
Authorization and Authentication Gaps:
Three notes address missing authorization checks or authentication mechanisms, particularly in NetWeaver AS ABAP, S/4HANA components, and HANA hdbrss.
Update Pattern Refinement:
2 updates to previous notes from October and February releases demonstrate SAP’s iterative approach to critical fixes.
Information Exposure Concerns:
Three information disclosure vulnerabilities highlight data protection challenges across client and server components.
The botton line
November’s release demands immediate organizational response across all SAP environments:
- Emergency Patching Required for both CVSS 10.0 vulnerabilities: SQL Anywhere Monitor hard-coded credentials (immediate removal and migration to Cockpit required) and NetWeaver AS Java deserialization hardening.
- Immediate Action Needed for the code injection vulnerability in SAP Solution Manager (CVSS 9.9) to prevent authenticated attackers from achieving full system control.
- CoreFix 5 Implementation for all SAP Business Connector 4.8 deployments to address the concentrated set of four vulnerabilities.
- CommonCryptoLib Updates to version 8.5.60 or higher to prevent memory corruption vulnerabilities, with follow-up verification across all components embedding CommonCryptoLib per note 3628110.
- Authorization Architecture Review across NetWeaver AS ABAP and S/4HANA implementations to address persistent missing authorization check vulnerabilities.
This month’s patches reflect a continued high-threat environment with ongoing risks from hard-coded credentials, deserialization attacks, and code injection vulnerabilities. The iterative updates to critical security notes indicate that traditional single-patch approaches remain insufficient against evolving threats.
Organizations must prioritize immediate patching for all three critical vulnerabilities while implementing comprehensive security hardening measures for NetWeaver AS Java environments and Business Connector platforms.
At Vicxer, our SAP security experts streamline vulnerability management with real-time monitoring and tailored remediation strategies. Safeguard your landscape against evolving threats. Contact us today to fortify your SAP environment.