SAP S/4HANA Suffers Active Exploitation of Critical Vulnerability CVE-2025-42957

Sep 05, 2025
Vulnerability / Enterprise Security

A serious security flaw in SAP S/4HANA, a popular Enterprise Resource Planning (ERP) system, is currently being exploited in the wild. This command injection vulnerability, designated as CVE-2025-42957 and given a CVSS score of 9.9, was recently addressed by SAP in its monthly updates. According to the NIST National Vulnerability Database (NVD), “SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC.” This flaw allows for the injection of arbitrary ABAP code into the system, bypassing critical authorization checks. A successful attack could compromise the entire SAP environment, threatening the confidentiality, integrity, and availability of the system. Attackers could manipulate the SAP database, create superuser accounts with SAP_ALL privileges, extract password hashes, and disrupt business processes.

Active Exploitation of Critical SAP S/4HANA Vulnerability CVE-2025-42957

On September 5, 2025, a severe security vulnerability affecting SAP S/4HANA, a widely utilized Enterprise Resource Planning (ERP) software, has been confirmed as being exploited in the wild. This critical command injection vulnerability, identified as CVE-2025-42957, carries a CVSS score of 9.9, highlighting its extraordinary severity. Recent updates released by SAP last month included a fix for this flaw, but the urgency of the situation has prompted immediate attention from businesses relying on this platform.

The vulnerability arises from a flaw in a function module accessible through Remote Function Call (RFC), allowing attackers with user privileges to exploit the weakness. According to the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD), this defect facilitates the injection of arbitrary ABAP code into the SAP system, effectively circumventing vital authorization checks. Should this issue be successfully exploited, it poses a significant threat to the confidentiality, integrity, and availability of the entire SAP environment.

The ramifications of this vulnerability are extensive. Attackers can potentially manipulate the SAP database, create superuser accounts with unrestricted privileges, extract password hashes, and interfere with critical business processes. Such actions could lead to devastating disruptions within organizations that depend on SAP for their operational functions.

In terms of targeting, this vulnerability has put enterprises across various sectors at risk, particularly those heavily invested in SAP solutions. The primary operational bases for these businesses largely span multiple countries, including the United States and European nations, which are known for their robust SAP deployments.

Analyzing the tactics involved, the situation aligns with various techniques categorized under the MITRE ATT&CK framework. Initial access through leveraging existing user permissions may have enabled attackers to gain foothold within systems. Once inside, the exploitation of this vulnerability indicates a potential for privilege escalation, allowing the attainment of higher access levels not originally granted to the intruder.

This incident serves as a stark reminder of the persistent vulnerabilities that exist in even the most commercially popular software solutions. It underscores the critical nature of timely vulnerability management and the necessity for organizations to remain vigilant and responsive to security updates issued by software providers. As attackers adapt and refine their methods, a proactive approach to cybersecurity has never been more crucial for safeguarding business interests in today’s digital landscape.

For organizations utilizing SAP S/4HANA, reviewing security measures and ensuring compliance with the latest patches is imperative. The evolving threat landscape demands that business owners prioritize cybersecurity risks and invest in comprehensive strategies to mitigate potential breaches stemming from vulnerabilities like CVE-2025-42957.

Source link

Related Posts

TAG-150 Develops CastleRAT in Python and C, Enhancing CastleLoader Malware Operations

September 05, 2025
Botnet / Malware

The threat actor behind the malware-as-a-service (MaaS) framework and loader known as CastleLoader has introduced a remote access trojan, CastleRAT. Available in both Python and C versions, CastleRAT primarily functions to collect system information, download and execute additional payloads, and run commands via CMD and PowerShell, according to Recorded Future’s Insikt Group. The cybersecurity firm is monitoring the malicious activities attributed to TAG-150, which is believed to have been operational since at least March 2025. CastleLoader and its variants serve as initial access points for various secondary payloads, including other remote access trojans, information stealers, and additional loaders. CastleLoader (also referred to as CastleBot) was first reported by Swiss cybersecurity firm PRODAFT in July 2025, highlighting its use in campaigns distributing DeerStealer, RedLine, StealC, NetSupport RAT, SectopRAT, and Hijack Loader. Further analysis…

CISA Urges Immediate Patching of Critical Sitecore Vulnerability Under Active Attack

September 5, 2025
Vulnerability / Threat Intelligence

Federal Civilian Executive Branch (FCEB) agencies are directed to update their Sitecore systems by September 25, 2025, due to a critical security vulnerability, identified as CVE-2025-53690, that is currently being exploited. The vulnerability has a CVSS score of 9.0 out of 10, highlighting its severity. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), this flaw affects Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud, allowing for deserialization of untrusted data through default machine keys. This presents an opportunity for attackers to execute remote code by exploiting exposed ASP.NET machine keys. Mandiant, a Google-owned cybersecurity firm, reported that the ongoing ViewState deserialization attacks utilized a sample machine key found in Sitecore deployment guides from 2017 and earlier. The threat intelligence team…

“Noisy Bear Campaign Disguised as Phishing Test Revealed Targeting Kazakhstan’s Energy Sector”

Sep 06, 2025 – Malware / Cyber Espionage

A suspected Russian threat actor is behind a series of attacks aimed at Kazakhstan’s energy sector, identified as Operation BarrelFire by Seqrite Labs, which tracks the group as Noisy Bear. Active since at least April 2025, the campaign specifically targets employees of KazMunaiGas (KMG). The attackers delivered a counterfeit document purporting to be from the KMG IT department, mimicking legitimate internal communications and addressing topics like policy updates, certification processes, and salary adjustments. According to security researcher Subhajeet Singha, the infection process starts with a phishing email containing a ZIP file that includes a Windows shortcut (LNK) downloader, a decoy document related to KazMunaiGas, and a README.txt file with instructions in both Russian and Kazakh to execute a program named “KazMunayGaz_Viewer.”

⚡ Weekly Update: Drift Breach Unveiled, Active Zero-Days, Patch Alerts, Evolving Threats & More

 
Sep 08, 2025
Cybersecurity / Hacking News

Cybersecurity constantly evolves, with each week bringing fresh threats, vulnerabilities, and crucial lessons for defenders. For security and IT teams, the challenge lies in discerning which risks demand immediate attention. This digest aims to provide a straightforward briefing to help prioritize what matters most.

This week, the notable story is the Salesloft–Drift breach, where attackers compromised OAuth tokens, gaining access to Salesforce data from major tech companies. This incident underscores how fragile integrations can become critical vulnerabilities in enterprise defenses.

Additionally, we’ll discuss several high-risk CVEs currently under active exploitation, the latest strategies of advanced threat actors, and new insights on streamlining security workflows for greater efficiency. Each section delivers essential information, ensuring you stay informed and prepared without being overwhelmed.

⚡ Threat of the Week
Salesloft to Take Drift of…