CVE-2025-42876
High
Description
Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all company codes. Successful exploitation could result in a high impact to confidentiality and a low impact to integrity, while availability remains unaffected.
SeverityHigh
CVSS7.1
Exploit probability—
ProductSAP S/4 HANA Private Cloud (Financials General Ledger)
PublishedDec 9, 2025
First seenDec 9, 2025
Weakness typeCWE-405CWE-405
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SAP_SE SAP S/4 HANA Private Cloud (Financials General Ledger) | S4CORE 104, 105, 106, 107, 108, 109 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.