CVE-2025-43009: SAP SPM Privilege Escalation Vulnerability

CVE-2025-43009 Overview

CVE-2025-43009 is a missing authorization vulnerability [CWE-862] in SAP Service Parts Management (SPM). The application does not perform required authorization checks for authenticated users. An attacker with valid low-privileged credentials can escalate privileges within the SPM application. The flaw affects the confidentiality, integrity, and availability of the application at a low level. SAP published the fix as part of its monthly Security Patch Day cycle and tracks the correction under SAP Note 2491817.

Critical Impact
An authenticated attacker can perform actions beyond their assigned role, bypassing authorization controls in SAP Service Parts Management and escalating privileges within the application context.

Affected Products

SAP Service Parts Management (SPM)
Refer to SAP Note 2491817 for the specific supported package levels
SAP customers running SPM prior to the May 2025 Security Patch Day fixes

Discovery Timeline

2025-05-13 - CVE-2025-43009 published to the National Vulnerability Database
2025-05-13 - SAP released the security patch on Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43009

Vulnerability Analysis

The vulnerability is a broken access control issue in SAP Service Parts Management. SPM functions accessible to authenticated users do not verify whether the caller holds the roles or authorization objects required to invoke them. An attacker with a valid SAP account, even at low privilege, can trigger these code paths and perform actions reserved for higher-privileged roles.

The attack requires network access to the SAP application server and low privileges. No user interaction is needed, and the attack complexity is low. Exploitation stays within the SPM application scope and yields limited impact on each of confidentiality, integrity, and availability. The current EPSS probability is 0.249%, placing the CVE in the 16th percentile for likelihood of exploitation.

Root Cause

The root cause is a missing authorization check [CWE-862]. SAP transactions, RFC-enabled function modules, or web service endpoints in SPM execute business logic without validating the user's authorization objects. This omission breaks the SAP authorization concept, which relies on explicit AUTHORITY-CHECK statements to gate sensitive operations.

Attack Vector

An attacker authenticates to the SAP system with a standard user account. The attacker then invokes SPM functionality either through the SAP GUI, a browser-based interface, or a remote function call. Because the underlying code path does not enforce role checks, the operation completes with elevated effect. The result is horizontal or vertical privilege escalation within the SPM module. No exploitation code is publicly available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the SAP Note 2491817 and the SAP Security Patch Day Announcement for the vendor's technical details.

Detection Methods for CVE-2025-43009

Indicators of Compromise

Authentication events for SPM transactions or RFC modules originating from user accounts that historically do not access the module
SAP Security Audit Log entries showing successful execution of privileged SPM functions by low-privileged roles
Unexpected changes to service parts master data, planning parameters, or configuration attributable to non-administrative accounts

Detection Strategies

Enable the SAP Security Audit Log (transaction SM19/RSAU_CONFIG) with filters covering SPM transaction codes and RFC function groups
Review SAP SU53 authorization traces and ST01 system traces for calls that succeed without expected authorization objects
Correlate SPM activity with user role assignments in SAP Governance, Risk, and Compliance (GRC) or in AGR_USERS to flag out-of-role behavior

Monitoring Recommendations

Forward SAP Security Audit Log and Read Access Logging data to a SIEM for behavioral baselining
Alert on SPM function execution by accounts outside the authorized SPM user population
Track privileged operations in SPM master data tables and reconcile against change management tickets

How to Mitigate CVE-2025-43009

Immediate Actions Required

Apply the SAP correction referenced in SAP Note 2491817 on all systems running SAP Service Parts Management
Inventory user accounts with access to SPM transactions and RFC function modules, and remove access that is not business-justified
Review recent SAP Security Audit Log data for unauthorized SPM activity prior to patch deployment

Patch Information

SAP published the fix on Security Patch Day. Customers must download and install the correction described in SAP Note 2491817 through the SAP ONE Support Launchpad. The advisory landing page for this and other May 2025 fixes is available at the SAP Security Patch Day Announcement.

Workarounds

Restrict SPM transaction codes and RFC function groups to a minimal set of business users through SAP role adjustments in PFCG
Disable or lock unused SPM RFC-enabled function modules until the SAP correction is applied
Monitor SPM activity aggressively through the SAP Security Audit Log while the patch rollout is in progress

bash

# Example: enable Security Audit Log filtering for suspect users via RSAU_CONFIG
# 1. Run transaction RSAU_CONFIG
# 2. Create a static profile that logs successful and failed transactions
#    for users assigned to SPM roles
# 3. Activate the profile and reload the audit configuration
#    Filter: Client=*  User=<SPM_USER_GROUP>  Events=AU1,AU2,AUC,AUE