CVE-2025-27430: SSRF in SAP CRM and SAP S/4HANA

The SSRF vulnerability in SAP CRM and S/4HANA allows an attacker to craft malicious requests that originate from the server itself. This bypasses typical network security controls, enabling access to internal resources that would normally be inaccessible from the outside. Successful exploitation could lead to the exposure of sensitive data stored on internal systems, such as configuration files, database credentials, or proprietary business information. While the vulnerability does not directly impact data integrity or availability, the confidentiality breach can have significant consequences, including compliance violations and reputational damage. The low privilege requirement makes this vulnerability particularly concerning, as it reduces the barrier to entry for potential attackers.

1. Reserved2025-02-25
2. Published2025-03-11
3. EPSS updated2026-04-02

The primary mitigation for CVE-2025-27430 is to upgrade to version 701.0.1 or later. Prior to upgrading, it's crucial to review SAP's official documentation for compatibility and potential breaking changes. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting outbound network access from the affected component using a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests to internal IP addresses or specific internal services. Regularly monitor system logs for suspicious outbound requests originating from the SAP CRM/S/4HANA component. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability and verifying that the request is blocked or redirected.