
- CVE-2025-42887 in SAP Solution Manager allows unauthenticated code injection and full system takeover
- Vulnerability scored 9.9/10; patch released in SAP’s November 2025 update
- SAP also fixed CVE-2024-42890, a 10/10 flaw in SQL Anywhere Monitor
SAP Solution Manager, an application lifecycle management (ALM) platform with tens of thousands of user organizations, carried a critical severity vulnerability that allowed threat actors to fully take over compromised endpoints, experts have warned.