Introduction
Attackers who exploit code injection flaws in SAP S/4HANA have shown they can bypass critical authorization controls and fully compromise the system. For organizations running SAP S/4HANA, a single vulnerability of this kind can undermine the confidentiality, integrity, and availability of core business operations.
SAP SE dominates enterprise software, with over 440,000 customers worldwide, and SAP S/4HANA is its flagship ERP suite. Companies across industries run their central business processes on it, so vulnerabilities in its core components have a large impact on the global tech ecosystem.
Technical Information
CVE-2025-42957 is a critical vulnerability in SAP S/4HANA that lets authenticated attackers inject arbitrary ABAP code via exposed RFC-enabled function modules. The flaw is classified as CWE-94 (Improper Control of Generation of Code) and carries a CVSS score of 9.9.
The cause is insufficient input validation and sanitization in specific RFC function modules. An attacker with valid SAP credentials and S_RFC authorizations can call a vulnerable function module and pass crafted input that goes directly into dynamic ABAP code execution constructs. This bypasses the standard authorization checks and gives the attacker arbitrary code execution inside the SAP environment.
A successful exploit lets an attacker:
- Escalate privileges by assigning themselves additional authorizations or creating new privileged accounts
- Modify or create SAP programs in standard namespaces to plant persistent backdoors
- Bypass system and client modifiability locks
The vulnerability is similar to CVE-2025-27429, which affected SAP S/4HANA before April 2025 and was found in a function module of fewer than 40 lines of code. The attack works by calling RFC-enabled modules with crafted parameters and abusing ABAP's dynamic code generation features, such as INSERT REPORT or GENERATE SUBROUTINE POOL.
Affected Systems and Versions
- SAP S/4HANA (exact affected versions not specified in public sources)
- The vulnerability is present in RFC-enabled function modules prior to the patch provided in SAP Security Note 3627998
- Similar vulnerabilities (e.g., CVE-2025-27429) affected SAP S/4HANA versions prior to April 2025
- Both private cloud and on-premise deployments are affected
Vendor Security History
SAP has a record of repeated critical vulnerabilities in its RFC and ABAP code execution paths. Examples include:
- CVE-2025-27429 (ABAP code injection via RFC, patched April 2025)
- CVE-2025-42967 (code injection in SAP S/4HANA and SCM, patched July 2025)
- CVE-2025-31324 and CVE-2025-42999 (Visual Composer vulnerabilities actively exploited by APT groups)
SAP releases patches on a monthly cycle and works with external security researchers. Its patch response times have improved, and it publishes detailed advisories with CVSS scores. Still, RFC and code injection flaws keep appearing, which indicates ongoing problems in SAP's secure development practices.
