CVE-2025-27429

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

• CWE-94

• https://me.sap.com/notes/3581961
• https://url.sap/sapsecuritypatchday

Published

Apr 8, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27423Vim is an open source, command line text editor. Vim is dist…7.1
• CVE-2025-27424Websites redirecting to a non-HTTP scheme URL could allow a …4.3
• CVE-2025-27425Scanning certain QR codes that included text with a website …4.3
• CVE-2025-27426Malicious websites utilizing a server-side redirect to an in…5.4
• CVE-2025-27427A vulnerability exists in Apache ActiveMQ Artemis whereby a …4.3
• CVE-2025-27428Due to directory traversal vulnerability, an authorized atta…7.7
• CVE-2025-2743A vulnerability, which was classified as problematic, has be…8.1
• CVE-2025-27430Under certain conditions, an SSRF vulnerability in SAP CRM a…3.5
• CVE-2025-27431User management functionality in SAP NetWeaver Application S…5.4
• CVE-2025-27432The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoi…2.4
• CVE-2025-27433The Manage Bank Statements in SAP S/4HANA allows authenticat…4.3
• CVE-2025-27434Due to insufficient input validation, SAP Commerce (Swagger …8.8