{"id":13404,"date":"2025-07-10T09:21:38","date_gmt":"2025-07-10T07:21:38","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=13404"},"modified":"2025-07-10T09:21:38","modified_gmt":"2025-07-10T07:21:38","slug":"sap-security-notes-july-2025","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/","title":{"rendered":"SAP Security Notes, July 2025"},"content":{"rendered":"<p><strong>Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems.<\/strong><\/p>\n\n<h2>July 2025 Notes<\/h2>\n<h3>Summary and Highlights of the Month<\/h3>\n<div>This month, the total number of notes was 31, which is 17 more than the previous month. This month we had 6 Hot News, 5 more than in the previous period. Regarding high-criticality notes, there are 5, the same as in the past 3 months. The medium and low notes will not be reviewed, so we will provide details for a total of 11 notes (all with a CVSS of 7 or higher).We have a total of 31 notes for the whole month (27 new ones and 4 updates of notes published in previous months).<\/p>\n<p>We will review in detail a total of 11 notes, all of them high-criticality and Hot News:<\/p>\n<ol start=\"1\">\n<li>\n<div role=\"presentation\"><b>The most critical note of the month (CVSS<\/b> <span style=\"color: #ff0000;\"><b>10<\/b><\/span><b>)<\/b> is a Hot News and it is an update of a note published in May related to <b>\u201cMultiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)\u201d<\/b>.<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">The next one in terms of criticality <b>(CVSS <\/b><span style=\"color: #ff0000;\"><b>9.9<\/b><\/span><b>)<\/b> is a note related to <b>\u201cCode Injection vulnerability in SAP S\/4HANA and SAP SCM (Characteristic Propagation)\u201d<\/b>.<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">The next ones in terms of criticality <b>(CVSS <\/b><span style=\"color: #ff0000;\"><b>9.1<\/b><\/span><b>)<\/b> are 4 Hot News related to <b>\u201cInsecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network\u201d, \u201cInsecure Deserialization in SAP NetWeaver Enterprise Portal Administration\u201d, \u201cInsecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)\u201d<\/b> and <b>\u201cInsecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer)\u201d<\/b>.<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">The next ones in terms of criticality <b>(CVSS <\/b><span style=\"color: #ff0000;\"><b>8.1<\/b><\/span><b>)<\/b> are two high-criticality notes related to <b>\u201cMissing Authentication check after implementation of SAP Security Note 3007182 and 3537476\u201d<\/b> and <b>\u201cMissing Authorization check in SAP NetWeaver Application Server for ABAP\u201d<\/b>.<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">The next one in terms of criticality <b>(CVSS <\/b><span style=\"color: #ff0000;\"><b>8.0<\/b><\/span><b>)<\/b> is a note related to <b>\u201cInsecure File Operations vulnerability in SAP Business Objects Business Intelligence Platform (CMC)\u201d<\/b>.<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">The next one in terms of criticality <b>(CVSS <\/b><span style=\"color: #ff9900;\"><b>7.7<\/b><\/span><b>)<\/b> is a note related to <b>\u201cMissing Authorization check in SAP Business Warehouse and SAP Plug-In Basis\u201d<\/b>.<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">Finally, the last note we will analyze and the lowest in criticality <b>(CVSS <\/b><span style=\"color: #ff9900;\"><b>7.6<\/b><\/span><b>)<\/b> is an update of a note from last month related to <b>\u201cDirectory Traversal vulnerability in SAP NetWeaver Visual Composer\u201d<\/b>.<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">This month the most predominant type is <b>\u201cMissing Authorization Check\u201d (8\/31 on patch day)<\/b>.<\/div>\n<\/li>\n<\/ol>\n<p>In the chart, we can see the <b><u>classification of the July notes<\/u><\/b>, as well as the evolution and classification for the past 5 months (only the Sec. Tuesday \/ Patch Day notes \u2013 by SAP).<br \/>\n<img decoding=\"async\" class=\"aligncenter wp-image-13405\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025.jpg\" alt=\"\" width=\"702\" height=\"368\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025.jpg 1200w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025-300x158.jpg 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025-1024x538.jpg 1024w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025-600x315.jpg 600w\" sizes=\"(max-width: 702px) 100vw, 702px\" \/><\/p>\n<\/div>\n<h3>Full details<\/h3>\n<p>The <strong>complete detail of the most relevant notes<\/strong> is as follows:<\/p>\n<ol start=\"1\">\n<li>\n<div role=\"presentation\"><b>Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit) (update)<\/b><b> <u>(<\/u><\/b><b><a id=\"OWA4c2ef813-0585-b50c-c6e7-23c448e3a960\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3578900\" data-auth=\"NotApplicable\">3578900<\/a><\/b><\/div>\n<div role=\"presentation\"><b><u>)<\/u>:<\/b>\u00a0This SAP Security Note\u00a0addresses five critical vulnerabilities in SRM Live Auction Cockpit, including a critical insecure deserialization flaw (CVE-2025-30012) with a CVSS score of 10.0. The issues stem from deprecated Java Applet components, now fully removed or replaced in newer versions. SAP recommends migrating to DHTML-based SRM Live Auction or removing legacy components using deployment tools. Refer to Notes 2369341, 2171391, and 1715441 for remediation steps.<b>\u00a0CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>10<\/b><\/span><b>\/ 10 [<\/b><b><a id=\"OWAa3300b9e-9696-8e4c-70d3-dce864b2aa57\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-30012\" data-auth=\"NotApplicable\">CVE-2025-30012<\/a><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>Code Injection vulnerability in SAP S\/4HANA and SAP SCM (Characteristic Propagation)<\/b><b><u>\u00a0(<\/u><\/b><b><a id=\"OWA680c0d5e-ea4f-d24e-fb92-8f64a63804f8\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3618955\" data-auth=\"NotApplicable\">3618955<\/a><\/b><b><u>)<\/u>:<\/b>\u00a0A remote code execution vulnerability in SAP S\/4HANA and SCM Characteristic Propagation allows authenticated internal users to inject and execute OS-level commands, risking full system compromise. The issue is mitigated by blocking the injection of malicious code from external systems. Apply the relevant correction instructions or support packages to resolve the vulnerability. There is no workaround. <b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>9,9<\/b><\/span><b>\/ 10 [<\/b><b><a id=\"OWA7ce6d226-1071-5a89-956a-846a00c6947f\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-42967\" data-auth=\"NotApplicable\">CVE-2025-42967<\/a><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network<\/b><b>\u00a0(<\/b><b><a id=\"OWA342ba198-df6c-553a-63c1-daf9cf86fe19\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3620498\" data-auth=\"NotApplicable\">3620498<\/a><\/b><b>) <\/b>SAP NetWeaver Enterprise Portal (FPN) has an insecure deserialization vulnerability that may allow privileged users to execute malicious code, compromising system security. The deserialization logic has been improved to validate input. SAP recommends applying the provided patches, as the optional workaround is only a temporary measure and the vulnerable endpoint is already access-restricted to admin users.<b>\u00a0CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>9,1<\/b><\/span><b>\/ 10\u00a0 [<\/b><b><a id=\"OWA20c04ec8-90a4-6d38-1675-b25a9a4bf975\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-42980\" data-auth=\"NotApplicable\">CVE-2025-42980<\/a><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>\u00a0<\/b><b>Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration<\/b><b>) (<\/b><b><a id=\"OWA5bb43a8c-5983-773a-acec-789ca4e198e8\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3621236\" data-auth=\"NotApplicable\">3621236<\/a><\/b><b>): <\/b>A vulnerability in SAP NetWeaver Enterprise Portal Administration\u00a0allows privileged users to upload and deserialize malicious content, potentially leading to remote code execution. Input validation during deserialization has been enhanced. SAP recommends applying the relevant patches, as the workaround is only temporary and the vulnerable endpoint is already limited to highly privileged administrators.<b>\u00a0CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>9,1<\/b><\/span><b>\/ 10 [<\/b><b><a id=\"OWAfc0eaab4-1195-80b0-2f5e-c4c21a61e78c\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-42964\" data-auth=\"NotApplicable\">CVE-2025-42964<\/a><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)<\/b><b>\u00a0(<\/b><b><a id=\"OWA55606698-f51f-416a-24b8-afc55fdcc6fc\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3610892\" data-auth=\"NotApplicable\">3610892<\/a><\/b><b>): <\/b>SAP NetWeaver XML Data Archiving Service (XML DAS) contains an insecure Java deserialization vulnerability that can be exploited by authenticated admin users, potentially compromising system confidentiality, integrity, and availability. The deserialization logic has been strengthened. Apply the corresponding patch and follow SAP Note 952402 for full remediation<b>. CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>9,1<\/b><\/span><b>\/ 10\u00a0 [<\/b><b><a id=\"OWAc20caa2f-a6e3-e927-d2e0-74c6504f1ecf\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-42966\" data-auth=\"NotApplicable\">CVE-2025-42966<\/a><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer )<\/b><b>\u00a0(<\/b><b><a id=\"OWA5fd4747b-fe74-c6f6-8d4c-f36cceeb8818\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3621771\" data-auth=\"NotApplicable\">3621771<\/a><\/b><b>):<\/b> A critical vulnerability in SAP NetWeaver AS Java Log Viewer allows authenticated admin users to exploit unsafe Java deserialization, potentially leading to full OS compromise. The patch eliminates the issue by removing the vulnerable RM module. SAP recommends applying the relevant support packages and reviewing SAP Note 1974464 to avoid dependency issues. As a temporary workaround, the LogViewer component can be disabled via a startup filter, with logs still accessible through SAP MMC or the file system. Full details are provided in FAQ note 3626657. <b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>9,1<\/b><\/span><b>\/ 10 [<\/b><b><a id=\"OWA97e91705-dafd-2241-5c83-16cd4c4829d2\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-42963\" data-auth=\"NotApplicable\">CVE-2025-42963<\/a><\/b><b>]<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476 <\/b><b>(<\/b><b><a id=\"OWA90e4e7f7-e9d4-3c79-48d8-09c13c5a693e\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3600846\" data-auth=\"NotApplicable\">3600846<\/a><\/b><b>):<\/b><b>\u00a0<\/b>A replay attack vulnerability\u00a0allows an unauthenticated attacker to reuse a Hashed Message Authentication Code (HMAC) credential from a system missing specific security patches, potentially compromising a fully patched target system. The solution involves deleting and regenerating the HMAC key, with careful validation of system state to avoid issues with tRFC, qRFC, bgRFC, or recorded HTTP calls. Follow the steps outlined to delete the old HMAC key and regenerate it during a short downtime, ensuring secure system operations.<b>\u00a0<\/b><b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>8,1<\/b><\/span><b>\/ 10\u00a0 [<\/b><b><a id=\"OWA9c625daf-434f-df1d-4ba7-077a10ff9004\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-42959\" data-auth=\"NotApplicable\">CVE-2025-42959<\/a><\/b><b>]<\/b><\/div>\n<div role=\"presentation\"><b>\u00a0<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>Missing Authorization check in SAP NetWeaver Application Server for ABAP <\/b><b>(<\/b><b><a id=\"OWA5765d6e3-1142-6fe1-1fce-2789cdc3b2cd\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3623440\" data-auth=\"NotApplicable\">3623440<\/a><\/b><b>):<\/b><b>\u00a0<\/b>A privilege escalation vulnerability in SAP NetWeaver System Configuration allows authenticated users to bypass necessary authorization checks,\u00a0potentially compromising the system\u2019s integrity and availability. The solution involves implementing an authorization check for the &#8216;S_RZL_ADM&#8217; profile with Activity &#8217;01&#8217;. SAP recommends applying the support package or correction instructions provided. As a temporary workaround, restrict the use of the S_RFC authorization to specific functions or function groups, though the permanent fix is preferred.<b>\u00a0<\/b><b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>8,1<\/b><\/span><b>\/ 10\u00a0 [<\/b><b><a id=\"OWAbc2febd9-3468-dddf-d0ab-a496f015452e\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-42953\" data-auth=\"NotApplicable\">CVE-2025-42953<\/a><\/b><b>]<\/b><\/div>\n<div role=\"presentation\"><b>\u00a0<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>Insecure File Operations vulnerability in SAP Business Objects Business Intelligence Platform (CMC) <\/b><b>(<\/b><b><a id=\"OWA17530820-6776-97a3-454f-903a2471bb85\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3565279\" data-auth=\"NotApplicable\">3565279<\/a><\/b><b>): <\/b>SAP Business Objects Business Intelligence Platform (CMC) uses an older version of Apache Struts (2.5.33) with the vulnerability, which allows for unrestricted file uploads and potential malicious file execution by administrators. The solution is to update Apache Struts to a secure version. SAP recommends applying the necessary patches listed in the security note. For additional details, refer to Knowledge Base Article 2144559 regarding maintenance strategy. There is no workaround.<b>\u00a0<\/b><b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff0000;\"><b>8,0<\/b><\/span><b>\/ 10 [<\/b><b><a id=\"OWA4d93d946-8aeb-933f-8d46-eb14180f596f\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-53677\" data-auth=\"NotApplicable\">CVE-2024-53677<\/a><\/b><b>]<\/b><\/div>\n<div role=\"presentation\"><b>\u00a0<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis <\/b><b>(<\/b><b><a id=\"OWA692efa7a-df41-24e6-e205-0e023a65dfd7\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3623255\" data-auth=\"NotApplicable\">3623255<\/a><\/b><b>): <\/b>A vulnerability\u00a0in SAP Business Warehouse and SAP Plug-In Basis allows authenticated attackers to add fields to SAP database tables or structures, potentially causing system short dumps and impacting availability. The issue stems from missing authorization checks in a report comparing middleware structures between CRM and ERP. The solution involves adding an authorization check (SCRMMW) to the affected RFC function module. SAP recommends implementing the correction instructions or support packages provided in the security note.<b>\u00a0<\/b><b>CVSS v3\u00a0Base Score<\/b><b>\u00a0<span style=\"color: #ff9900;\">7,7<\/span><\/b><b>\/ 10\u00a0 [<\/b><b><a id=\"OWA30bc109f-13d1-cfa4-0752-8ec7cc8d53f1\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-42952\" data-auth=\"NotApplicable\">CVE-2025-42952<\/a><\/b><b>]<\/b><\/div>\n<div role=\"presentation\"><b>\u00a0<\/b><\/div>\n<\/li>\n<li>\n<div role=\"presentation\"><b>Directory Traversal vulnerability in SAP NetWeaver Visual Composer (update) <\/b><b>(<\/b><b><a id=\"OWA289985bc-0b8a-9887-71c5-292318f2736b\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/me.sap.com\/notes\/3610591\" data-auth=\"NotApplicable\">3610591<\/a><\/b><b>): <\/b>SAP NetWeaver Visual Composer has a Directory Traversal vulnerability caused by insufficient validation of input paths from high-privileged users, allowing arbitrary file access and compromising confidentiality. The issue has been addressed by improving URL parameter validation. The update reintroduces a workaround for versions without a patch, which involves un-deploying the VisualComposerServerEar05.ear file (part of VCBASE.SCA). SAP recommends applying the relevant support packages or patches and reviewing KBA 3619959 for more information on the workaround. <b>CVSS v3\u00a0Base Score <\/b><span style=\"color: #ff9900;\"><b>7,6<\/b><\/span><b>\/ 10\u00a0 [<\/b><b><a id=\"OWA0dc91dad-936f-92f1-b6f5-6944f58f1abb\" class=\"x_x_x_x_OWAAutoLink x_x_x_x_elementToProof\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-42977\" data-auth=\"NotApplicable\">CVE-2025-42977<\/a><\/b><b>]<\/b><\/div>\n<\/li>\n<\/ol>\n<h3 style=\"font-weight: 400;\"><strong>Reference links<\/strong><\/h3>\n<p>Other references, from SAP and Onapsis (july):<\/p>\n<p><b><a id=\"OWA8e6eb19d-45c9-7553-48db-f02805aa9fe8\" class=\"x_x_x_x_OWAAutoLink x_elementToProof\" title=\"https:\/\/support.sap.com\/en\/my-support\/knowledge-base\/security-notes-news\/july-2025.html\" href=\"https:\/\/support.sap.com\/en\/my-support\/knowledge-base\/security-notes-news\/july-2025.html\" data-auth=\"NotApplicable\">SAP Security Patch Day &#8211; July 2025<\/a><\/b><\/p>\n<p><b><a id=\"OWAa0c05673-d537-c948-9457-e2ef6f372672\" class=\"x_x_x_x_OWAAutoLink\" title=\"https:\/\/onapsis.com\/blog\/sap-security-notes-july-2025-patch-day\/\" href=\"https:\/\/onapsis.com\/blog\/sap-security-notes-july-2025-patch-day\/\" data-auth=\"NotApplicable\">SAP Patch Day: July 2025 &#8211; Onapsis<\/a><\/b><\/p>\n<p>&nbsp;<\/p>\n<p><strong style=\"color: #014888; font-family: inherit; font-size: 1.6rem; letter-spacing: 0em;\"><u>Resources affected<\/u><\/strong><\/p>\n<div class=\"w-post-elm post_content\">\n<p>The full list of affected systems\/components is as follows:<\/p>\n<ul>\n<li>\n<div role=\"presentation\">SAP Supplier Relationship Management (Live Auction Cockpit) Version \u2013 SRM_SERVER 7.14<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">SAP S\/4HANA and SAP SCM (Characteristic Propagation) Versions \u2013 SCMAPO 713, 714, S4CORE 102, 103, 104, S4COREOP\u00a0105, 106, 107, 108, SCM 700, 701, 702, 712<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">SAP NetWeaver Enterprise Portal Federated Portal Network Version \u2013 EP-RUNTIME 7.50<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">SAP NetWeaver Enterprise Portal Administration Version \u2013 EP-RUNTIME 7.50<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">SAP NetWeaver (XML Data Archiving Service) Version \u2013 J2EE-APPS 7.50<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">SAP NetWeaver Application Server for Java (Log Viewer) Version \u2013 LMNWABASICAPPS 7.50<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">SAP NetWeaver ABAP Server and ABAP Platform Versions \u2013 SAP_BASIS 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 914, 915<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">SAP Business Objects Business Intelligence Platform (CMC) Versions \u2013 ENTERPRISE 430, 2025<\/div>\n<\/li>\n<li>\n<div role=\"presentation\">SAP Business Warehouse and SAP Plug-In Basis Versions \u2013 PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816<\/div>\n<\/li>\n<li>\n<div class=\"elementToProof\" role=\"presentation\">SAP NetWeaver Visual Composer Version \u2013 VCBASE 7.50<\/div>\n<\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Inprosec through its services, such as the SAP Security Assessment, helps its customers to improve the security levels of their SAP systems. July 2025 Notes Summary and Highlights of the Month This month, the total number of notes was 31, which is 17 more than the previous month. This month we had 6 Hot News,&#8230;<\/p>\n","protected":false},"author":6,"featured_media":13406,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[95,61],"tags":[150],"class_list":["post-13404","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sap-notes","category-sap-security-en-2","tag-sap-notes"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.3 (Yoast SEO v27.4) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>SAP Security Notes, July 2025 - Inprosec<\/title>\n<meta name=\"description\" content=\"All updates to SAP systems notes from july 2025, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SAP Security Notes, July 2025\" \/>\n<meta property=\"og:description\" content=\"All updates to SAP systems notes from july 2025, to stay current and improve the security levels of your SAP systems.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/\" \/>\n<meta property=\"og:site_name\" content=\"Inprosec\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-10T07:21:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fernando Mosquera\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Mosquera\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/\"},\"author\":{\"name\":\"Fernando Mosquera\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"headline\":\"SAP Security Notes, July 2025\",\"datePublished\":\"2025-07-10T07:21:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/\"},\"wordCount\":1466,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/notas-sap-julio-2025.jpg\",\"keywords\":[\"SAP Notes\"],\"articleSection\":[\"SAP Notes\",\"SAP Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/\",\"name\":\"SAP Security Notes, July 2025 - Inprosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/notas-sap-julio-2025.jpg\",\"datePublished\":\"2025-07-10T07:21:38+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"description\":\"All updates to SAP systems notes from july 2025, to stay current and improve the security levels of your SAP systems.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/notas-sap-julio-2025.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/notas-sap-julio-2025.jpg\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/sap-security-notes-july-2025\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SAP Security Notes, July 2025\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\",\"name\":\"Inprosec\",\"description\":\"Information security is our priority.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\",\"name\":\"Fernando Mosquera\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"caption\":\"Fernando Mosquera\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SAP Security Notes, July 2025 - Inprosec","description":"All updates to SAP systems notes from july 2025, to stay current and improve the security levels of your SAP systems.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/","og_locale":"en_US","og_type":"article","og_title":"SAP Security Notes, July 2025","og_description":"All updates to SAP systems notes from july 2025, to stay current and improve the security levels of your SAP systems.","og_url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/","og_site_name":"Inprosec","article_published_time":"2025-07-10T07:21:38+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025.jpg","type":"image\/jpeg"}],"author":"Fernando Mosquera","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fernando Mosquera","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/#article","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/"},"author":{"name":"Fernando Mosquera","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"headline":"SAP Security Notes, July 2025","datePublished":"2025-07-10T07:21:38+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/"},"wordCount":1466,"commentCount":0,"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025.jpg","keywords":["SAP Notes"],"articleSection":["SAP Notes","SAP Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/","url":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/","name":"SAP Security Notes, July 2025 - Inprosec","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/#primaryimage"},"image":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025.jpg","datePublished":"2025-07-10T07:21:38+00:00","author":{"@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"description":"All updates to SAP systems notes from july 2025, to stay current and improve the security levels of your SAP systems.","breadcrumb":{"@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/#primaryimage","url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025.jpg","contentUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2025\/07\/notas-sap-julio-2025.jpg","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2025\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inprosec.com\/en\/"},{"@type":"ListItem","position":2,"name":"SAP Security Notes, July 2025"}]},{"@type":"WebSite","@id":"https:\/\/www.inprosec.com\/en\/#website","url":"https:\/\/www.inprosec.com\/en\/","name":"Inprosec","description":"Information security is our priority.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inprosec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2","name":"Fernando Mosquera","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","caption":"Fernando Mosquera"}}]}},"_links":{"self":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/13404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/comments?post=13404"}],"version-history":[{"count":1,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/13404\/revisions"}],"predecessor-version":[{"id":13409,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/13404\/revisions\/13409"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media\/13406"}],"wp:attachment":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media?parent=13404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/categories?post=13404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/tags?post=13404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}