SAP Patches Critical Flaws in NetWeaver, Approuter, and Commerce Cloud

Key points

• SAP released security fixes in 2025 for critical vulnerabilities, meaning severe software flaws, affecting NetWeaver, Approuter, and Commerce Cloud.
• The flaws could let attackers read and alter business data, knock systems offline, or cause request-response desynchronization between servers and users.
• SAP NetWeaver is one of the most widely deployed enterprise platforms on the planet, running core business processes at major corporations and government agencies.
• No public evidence of active exploitation has been confirmed at time of writing, but critical SAP flaws attract attention quickly.

SAP, the German software giant whose products run payroll and finance systems at a large share of the world's biggest companies, has patched critical vulnerabilities across three of its major products. SecurityWeek first reported the disclosures.

The affected products are SAP NetWeaver (the core integration platform that connects SAP applications), SAP Approuter (a service that manages how web requests are routed to the right application), and SAP Commerce Cloud (the company's e-commerce platform used by retailers and manufacturers).

According to SAP's advisories, an attacker who exploits these flaws could access sensitive data without permission, alter it, make systems unavailable, and trigger request-response desynchronization, where the software confuses one user's web session with another's and potentially exposes private information across accounts.

What does this mean for ordinary people?

If your employer or bank runs SAP software and hasn't applied these patches, criminals could potentially reach internal business records or disrupt the services you depend on. The risk to individuals is indirect: your data sits inside systems these products protect, and you wouldn't know it was happening.

For IT teams, the action is clear. Check your SAP deployments against the patched versions listed in the official SAP Security Notes, available through the SAP Support Portal, and apply the patches. Prioritise NetWeaver given its central role connecting other systems.

SAP pushes security patches on the second Tuesday of each month, a cycle known as SAP Patch Day. Missing even one cycle on a critical fix is a material risk when the affected product handles payroll or customer orders. Threat Vectr has covered NetWeaver three times in the last 90 days, reflecting how consistently this platform draws researcher attention.

No specific CVE numbers with public NVD entries were available at publication time. This article will be updated when CVE IDs are confirmed. The researcher or team credited with finding these bugs had not been publicly named in available materials at time of writing.

Should you worry?

The honest answer is: yes, if you haven't patched. SAP systems are high-value targets precisely because they sit at the centre of financial and operational data. The pattern here is familiar, and it's not reassuring. We've reported recently on actively exploited flaws in Cisco phone software and Microsoft SharePoint where patches existed but organisations moved too slowly. SAP gives defenders the same window. The question is whether they use it.

If you run SAP products: patch now, check access logs for unusual data queries, and verify that your SAP systems aren't directly reachable from the public internet without strong authentication.