Vulnerability · critical · CVSS 10
SAP patches four CVSS 10.0 flaws including RCE
Tier A · Patch today – Before you go home
Who’s exposed: SAP customers running NetWeaver application server and affected SAP products
Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover
Reach
Attack
Damage
Fix
Popular tool · Remote, no login · Full takeover
What to do
- Apply SAP's Security Patch Day fixes for the four CVSS 10.0 flaws
The Brief
- SAP fixed four flaws rated CVSS 10.0, the maximum score, as part of its monthly Security Patch Day.
- The flaws can be exploited without logging in.
- Three flaws are in the SAP NetWeaver application server; the fourth is in a product the source text does not name, and two of the four enable remote code execution.
Why it matters
Unauthenticated flaws rated at the maximum CVSS score, including remote code execution, can give attackers control of SAP systems if they are not patched.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: SAP NetWeaver is enterprise server software that IT and ops teams run and maintain. |
| No | Core infrastructure | Judgment: a single vendor's enterprise platform, not shared core infrastructure like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: NetWeaver is a widely deployed platform across large enterprises, so it counts as mainstream. |
| No | Exploited in the wild | The Hacker News: reports only that flaws could be exploited and were patched; no observed attacks mentioned. |
| No | Public exploit | The Hacker News: reports patches for the flaws; no published exploit code or PoC mentioned. |
| Yes | Remote, no login | The Hacker News: four flaws attackers could exploit without logging in, rated CVSS 10.0. |
| Yes | Full takeover | The Hacker News: two of the flaws enable remote code execution. |
| No | Secrets exposed | The Hacker News: reports vulnerabilities patched; no data theft or exposure mentioned. |
| No | Supply chain | The Hacker News: vendor security patches for its own software; no malicious code shipped through a trusted channel. |
| No | No fix yet | The Hacker News: SAP patched all four flaws today on its Security Patch Day. |
Timeline
SAP fixed four CVSS 10.0 flaws as part of its monthly Security Patch Day
The Hacker News
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution
Source
SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution ↗ The Hacker News · 2h ago
First seen · 1 source · Full story page · How tiers are decided