medium2026-10-13SAP ABAP Platform — CRM componentsCVE-2025-42938
Malicious Content Execution via Crafted Links in CRM Components
SAP ABAP Platform / CRM
Our Take
Another reminder to read the prerequisites. Applying one note without its partner is the classic way to think you are patched.
Vulnerability Detail
Crafted links can lead to malicious content execution in the listed CRM components. This is an update to an older issue and also depends on a companion note.
Patch Action
Apply SAP Note 3629325 and the prerequisite Note 3499472 together.
Affected Versions
S4CEXT 107
108 (also requires Note 3499472)
Patch Info