PT-2025-46237 · Sap · Sap S/4Hana Core

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-42899

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP S4CORE (affected versions not specified)

Description The software does not perform required authorization checks for authenticated users when managing journal entries, potentially allowing for privilege escalation. The issue has a low impact on the confidentiality of the application and no impact on its integrity or availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-00232

CVE-2025-42899

Affected Products

Sap S/4Hana Core

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-42899 · Security Note
• https://bdu.fstec.ru/vul/2026-00232 · Security Note
• https://t.me/CVEtracker/36975 · Telegram Post
• https://me.sap.com/notes/3530544 · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/1988077276496621699 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988083641449083063 · Twitter Post