SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

SAP has fixed four vulnerabilities with the maximum CVSS score of 10.0 as part of its monthly Security Patch Day. All four flaws can be exploited by attackers without needing to log in. Three of the vulnerabilities are located in the SAP NetWeaver application server, which is the foundation of SAP systems. The fourth flaw is found in the Web Dispatcher component, which handles web requests from the internet and forwards them to the application server. Two of the vulnerabilities enable remote code execution. The vulnerabilities are considered critical due to their high CVSS score and potential for exploitation without authentication.