Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

SAP Solution Manager ST 720 code injection security flaw (CVE-2025-42880)

Vulnerability
First reported
Last updated
Happening score
H score 37
1 unique sources, 1 articles

Summary

Hide ▲

CVE-2025-42880 is a code injection flaw in SAP Solution Manager ST 720 that could let an authenticated attacker gain full control of the system. SAP included the fix in its December 2025 security updates, underscoring the risk to enterprise management environments.

Related Happenings

SAP NetWeaver Application Server ABAP SICF workaround for CVE-2026-44747

Advisory/Mitigation
H score40 First: 14.07.2026 21:17 Last: 14.07.2026 21:17 Sources 1

About this happening: SAP NetWeaver Application Server ABAP customers now have a temporary workaround for CVE-2026-44747 that can reduce exposure to memory corruption. The mitigation disabl...

Open Happening

CISA KEV listing for Wing FTP CVE-2025-47813

Public Sector Action
H score38 First: 17.03.2026 07:23 Last: 17.03.2026 07:23 Sources 1

About this happening: CISA added CVE-2025-47813 in Wing FTP Server to the KEV catalog after evidence of active exploitation, putting the flaw under formal government tracking. The listi...

Open Happening

CISA KEV remediation deadline for SolarWinds WHD CVE-2025-40551

Public Sector Action
H score53 First: 04.02.2026 07:50 Last: 04.02.2026 07:50 Sources 1

About this happening: CISA added CVE-2025-40551 in SolarWinds Web Help Desk to the KEV catalog and imposed federal remediation deadlines, turning a newly exploited flaw into a compl...

Open Happening

SAP NetWeaver AS Java deserialization RCE (CVE-2025-42944)

Vulnerability
H score39 First: 15.10.2025 08:36 Last: 15.10.2025 08:36 Sources 1

About this happening: SAP NetWeaver AS Java has a CVE-2025-42944 insecure deserialization flaw that can let an unauthenticated attacker trigger arbitrary OS command execution through th...

Open Happening

SAP S/4HANA command injection flaw (CVE-2025-42957)

Vulnerability
H score46 First: 05.09.2025 13:59 Last: 05.09.2025 13:59 Sources 1

About this happening: SAP S/4HANA is facing active exploitation of CVE-2025-42957, a critical command injection flaw that SAP fixed last month. The weakness affects on-premise and...

Latest development: 05.09.2025 16:36

SecurityBridge discovers CVE-2025-42957 in SAP S/4HANA, reports the RFC-exposed ABAP code injection flaw to SAP, and helps develop a patch for affected systems.

Open Happening

Timeline

  1. 10.12.2025 00:41 2 articles · 7mo ago

    SAP discloses CVE-2025-42880 in December 2025 updates

    Initial Disclosure

    SAP released December 2025 security updates covering 14 vulnerabilities across multiple products and identified CVE-2025-42880 as a CVSS 9.9 code injection flaw in SAP Solution Manager ST 720. The issue stems from missing input sanitation in a remote-enabled function module, where an authenticated attacker could insert malicious code and gain full control of the system with high impact on confidentiality, integrity, and availability.

    Show sources
    Open in new tab