CVE-2025-42916 — Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

CVE-2025-42916

Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise) PUBLISHED

Description (CNA)

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA (Private Cloud or On-Premise)	affected S4CORE 102; affected 103; affected 104; affected 105; affected 106; affected 107; affected 108

CWE

CWE-1287

References

https://me.sap.com/notes/3635475
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.