Do Son SAP's final patch of 2025 fixes a Critical Code Injection flaw (CVSS 9.9) in Solution Manager risking full system control. Also patched: Tomcat flaws (9.6) in Commerce Cloud and jConnect RCE.
Solution Manager
SAP released its Patch Day update fixing 18 flaws, including two Critical (CVSS 10.0) vulnerabilities: RMI-P4 RCE and Hard-Coded Credentials in SQL Anywhere Monitor, risking unauthenticated takeover.