Three critical vulnerabilities patched by SAP - here's what we know

Cybersecurity ensures data protection on internet. Data encryption, firewall, encrypted network, VPN, secure access and authentication defend against malware, hacking, cyber crime and digital threat.

• SAP’s December update patched 14 flaws, including three critical vulnerabilities in key products
• CVE‑2025‑42880 (9.9) in SAP Solution Manager allows code injection and full system compromise
• CVE‑2025‑55754 (9.6) in Apache Tomcat and CVE‑2025‑42928 (9.1) in SAP jConnect enable remote code execution under certain conditions

SAP has released its December cumulative security update, through which it fixed 14 vulnerabilities found in different products. Among them are three critical-severity flaws which should be addressed without delay.