medium2026-08-11SAP Financial AccountingCVE-2025-42947
Code Injection in SAP Financial Accounting Localization
SAP Financial Accounting Localization
Our Take
Note the 2025 CVE year — this is an older finding receiving a patch now. Relevant for localised financial accounting implementations. Next planned window.
Vulnerability Detail
A code injection vulnerability (originally assigned CVE-2025-42947) in the SAP Financial Accounting Localization component is being patched in August 2026. The vulnerability allows an authenticated attacker to inject code through localization-specific functionality, with potential for data manipulation in country-specific financial processes.
Patch Action
Apply SAP Note 3540688. Verify affected localization versions in the official SAP Note.
Patch Info