CVE-2025-42916: Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

Published Sep 9, 2025

Updated

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality.

Affected Software

1 affected component

SAP S/4HANA

Event History

Sep 9, 2025

CVE Published

via MITRE·02:07 AM

Data Sourced

via MITRE·02:07 AM

DescriptionSeverity

Data Sourced

via NVD·02:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-42916?

CVE-2025-42916 is considered a high severity vulnerability due to the potential for significant impact on database integrity and availability.

How do I fix CVE-2025-42916?

To fix CVE-2025-42916, ensure that proper input validation is implemented and that authorization groups protect sensitive database tables.

What software is affected by CVE-2025-42916?

CVE-2025-42916 affects SAP S/4HANA installations that lack appropriate protections for database tables.

Can CVE-2025-42916 allow unauthorized data deletion?

Yes, CVE-2025-42916 can allow attackers with high privilege access to delete arbitrary database table contents if not properly protected.

What impacts does CVE-2025-42916 have on an organization?

CVE-2025-42916 can lead to critical integrity and availability disruptions for affected organizations' databases.