SAP FIXED A MAXIMUM SEVERITY FLAW IN SQL ANYWHERE MONITOR

Summary from the TLDR InfoSec newsletter

SAP patched 19 vulnerabilities in November, including CVE-2025-42890 (CVSS 10/10), a critical hardcoded credentials flaw in SQL Anywhere Monitor (Non-GUI) that enabled arbitrary code execution with complete system compromise. Additional critical fixes include CVE-2025-42887 (CVSS 9.9) in SAP Solution Manager, which addresses code injection via missing input sanitization, and an update to CVE-2025-42944 that addresses insecure deserialization in SAP NetWeaver AS Java. Organizations should immediately discontinue SQL Anywhere Monitor usage, delete all monitor database instances, and apply patches across affected SAP products. No evidence of active exploitation has been reported.