Layer Seven, Author at Layer Seven Security

Layer Seven Security Named Top SAP Cybersecurity Protection Solution 2025

Layer Seven on August 26, 2025

We are pleased to announce the Cybersecurity Review has selected the Cybersecurity Extension for SAP from Layer Seven Security as the Top SAP Cybersecurity Solution 2025. The international publication with almost 300,000 subscribers worldwide performed a detailed review of several solutions that provide cybersecurity coverage for SAP applications and infrastructure. This included solutions offered by providers such as Onapsis, Security Bridge, and Pathlock, as well as SAP solutions such as Enterprise Threat Detection (ETD) and Code Vulnerability Analyzer (CVA). The criteria included coverage and capabilities for areas such as SAP vulnerability management, compliance reporting, patch management, custom code security, threat detection and response, and anomaly detection.

Other criteria included certification, deployment complexity and effort, maintenance, customer support, customization, integration with SIEM and incident management solutions, support for SAP RISE customers, user experience, and product roadmap. Licensing costs were also an important criteria given the recent drive for greater efficiency and lower costs in organizations.

The Cybersecurity Extension for SAP emerged as the leading solution across most of the criteria, specifically in areas such as coverage, support and licensing costs.

Coverage – The Cybersecurity Extension for SAP is the only solution in the market that delivers coverage for SAP vulnerability management, compliance reporting, patch management, custom code security, threat detection and response, and anomaly detection through a single integrated solution with a unified license. Other solutions require separate solutions or licenses for modular products. Some vendors such as SAP do not offer solutions for areas such as compliance reporting, patch management and vulnerability management.

The Cybersecurity Extension for SAP also provides deeper coverage across the domains with higher volumes of checks and patterns for vulnerability and threat detection than competitors.

The ability of the solution to support database and operating system security for SAP systems was also identified as a key differentiator. The Cybersecurity Extension supports full-stack monitoring for SAP systems, whereas most alternative solutions support only the application layer. This provides Layer Seven Security with an advantage in areas such as ransomware protection.

Certification – Earlier versions of the Cybersecurity Extension for SAP were certified for integration with SAP NetWeaver platforms. However, since the certification was discontinued by SAP, the solution is now certified for SAP HANA. The certification is performed by the SAP Integration and Certification Center and includes code reviews and testing performed by SAP.

Deployment Complexity and Effort – The Cybersecurity Extension for SAP benefits from a simplified architecture that does not require additional infrastructure including servers. This supports rapid deployment. The solution can be deployed as an addon to existing SAP systems including SAP GRC, BW, ECC, and S/4HANA. It can also be deployed to standalone SAP NetWeaver AS ABAP installations. The required addons are installed and configured within a few hours directly by SAP Basis administrators. Alternative solutions required additional servers and complex, time-intensive installation steps.

Maintenance – Content updates are provided by Layer Seven Security every month for new patches, vulnerability checks, and threat detection patterns. The updates can be performed in under 5 minutes with a few simple steps. Addon updates are provided on a quarterly cycle and include functional enhancements. They are applied using standard SAP steps for addon updates.

Customer Support – According to the Cybersecurity Review, customers singled out customer support as one of the strengths of Layer Seven Security. Customers commended the responsiveness of Layer Seven and valued the ability to reach out directly to dedicated engineers and developers without the need to go through regular support channels.

Customization – Layer Seven Security was also acknowledged by customers for their responsiveness to enhancement requests and customizations. Requests were handled promptly and implemented swiftly, often without any additional charges.

SIEM/ Incident Management Integration – The Cybersecurity Extension for SAP supports seamless integration with a wide variety of Security Information and Event Management (SIEM) solutions including Splunk, QRadar, Sentinel and LogRhythm. Integration is simple and straightforward and flexible to accommodate to multiple scenarios. Integration with service desk solutions such as ServiceNow and Remedy is also supported.

Support for RISE – The addon approach was found to be particularly suitable for SAP RISE scenarios. Customers can deploy and maintain the addon directly to SAP RISE systems without the support of SAP Enterprise Cloud Services (ECS). Furthermore, customers do not need to request the provisioning and maintenance of additional infrastructure from SAP ECS.

User Experience – The Cybersecurity Extension for SAP provides an integrated user interface using SAP Fiori. The Fiori-based applications provide a consistent and intuitive experience for SAP users since they follow the identical design principles of standard SAP applications. SAP users can navigate effortlessly through the solution and extend and personalize the user experience.

Product Roadmap – The three-year roadmap for the Cybersecurity Extension for SAP was found to be well aligned with the evolving needs of SAP customers, particularly in the area of support for SAP cloud services such as BTP, SuccessFactors, and Cloud ALM.

Licensing Costs – Despite the leading position commanded by Layer Seven Security in areas such as coverage, deployment, maintenance, support, and user experience, the Cybersecurity Solution for SAP was found to be one of the most competitively priced solutions in the market. Licensing costs were considerably lower than alternatives including Onapsis and Security Bridge. Licensing was also more transparent and did not include hidden fees and up-charges. Overall, the Cybersecurity Review determined that the Cybersecurity Extension for SAP offered the optimal cybersecurity protection for SAP solutions with the lowest total cost of ownership.

An official announcement by the Cybersecurity Review is expected in the coming weeks of the selection of the Cybersecurity Extension for SAP as the official Top SAP Cybersecurity Solution 2025. The management team at Layer Seven Security would like to recognize the dedication and efforts of all employees for the acknowledgment and the continued support of our customers and partners.

SAP Security Notes, August 2025

Layer Seven on August 20, 2025

Hot news notes 3581961 and 3627998 patch critical code injection vulnerabilities in SAP S/4HANA. Both notes have CVSS scores of 9.9/10. The vulnerabilities impact the function modules /SLOAP/GEN_MODULE_REPORT and /SLOAE/DEPLOY that can be exploited to install backdoors that bypass authorization checks. The function modules are used for reporting and analysis and are included in S4CORE.

Note 3633838 patches an equally critical code injection vulnerability in the Analysis Platform of SAP Landscape Transformation.

Note 3611184 addresses high risk memory corruption and reflected cross-site scripting (XSS) vulnerabilities in SAP NetWeaver Application Server ABAP (AS ABAP). The vulnerabilities impact BIC documents used for batch processing. As a workaround, the BIC ICF service can be deactivated using transaction SICF.

Note 3602656 patches a privilege escalation vulnerability in NetWeaver AS ABAP by improving permissions for the barcode interface using authorization object S_WFAR_OBJ.

Note 3601480 provides a kernel patch to prevent the logging of sensitive tokens in HTTP logs for the Internet Communication Manager (ICM) in NetWeaver AS ABAP. The vulnerability can also be addressed by avoiding the use of specific log formats using profile parameter icm/HTTP_logging_0.

Cybersecurity Extension for SAP, NetWeaver Edition

Layer Seven on July 29, 2025

Layer Seven Security is pleased to announce the official release of the Cybersecurity Extension for SAP, NetWeaver Edition. The release enables organizations to secure and monitor business-critical SAP applications without the need for Application Lifecycle Management (ALM) platforms such as SAP Solution Manager, SAP Focused Run, and Cloud ALM. The NetWeaver Edition can be deployed directly to SAP NetWeaver AS ABAP systems including SAP GRC, SAP ERP, and SAP S/4HANA.

The Cybersecurity Extension for SAP was originally developed as an addon for SAP ALM platforms. This supported rapid deployment and ease of maintenance since the Extension leveraged existing components and connections in ALM solutions, especially SAP Solution Manager (SolMan). However, SolMan is nearing the end of mainstream maintenance, scheduled for December 31 2027. Based on this, Layer Seven Security decided to redesign the Cybersecurity Extension for SAP starting in 2024 to operate independently of SolMan components such as the Extractor Framework, Configuration and Change Database (CCDB), System Recommendations, and the Monitoring and Alerting Infrastructure (MAI) including System Monitoring, as well as SolMan agents such as the Diagnostics Agent (DA). Similar components and agents are used in SAP Focused Run (FRUN). This initiative was completed successfully in July 2025. As a result, the Cybersecurity Extension for SAP can now be deployed to any NetWeaver AS ABAP system, version 7.40 or higher. The solution no longer requires ALM platforms such as SolMan and FRUN.

The NetWeaver Edition is available for all new customers of the Cybersecirty Extension for SAP. Existing customers can migrate to the NetWeaver Edition immediately or at any time before the end of mainstream maintenance for SolMan. The NetWeaver Edition also supports customers in SAP RISE and does not require external connections or integration with SAP Cloud ALM.

The first release of the NetWeaver Edition includes the full suite of core applications for SAP vulnerability management, patch management, custom code security, compliance reporting, and threat detection including security alerting and forensics. It supports all SAP ABAP and HANA solutions and SAP ASE databases. This includes SAP ECC and S/4HANA.

The second release scheduled for September 2025 will extend the coverage to include SAP AS Java, SAP Cloud Connector, SAProuter, SAP Web Dispatcher, and SAP Cloud Services including SAP BTP. It will also include applications such as Anomaly Detection and Trend Analysis.

Full parity between the NetWeaver and SolMan editions of the Cybersecurity Extension for SAP is targeted for December 2025. This includes support for operating system and database security for cross-stack monitoring of SAP systems.

SAP Security Notes, July 2025

Layer Seven on July 8, 2025

There are multiple hot news notes released in July for insecure deserialization vulnerabilities in SAP NetWeaver AS Java solutions and components. The vulnerabilities arise from the processing of untrusted user-provided serialized data without adequate input validation. This can lead to malicious code execution and authentication bypass. Notes 3610892, 3621236, 3620498 and 3621771 correct deserialization vulnerabilities in the XML Data Archiving Service, Enterprise Portal Administration, Federated Portal Network, and the Log Viewer, respectively. Workarounds are provided where available, including instructions for disabling the LogViewer. Note that log files can be analyzed directly in the file system or using SAP Management Console (SAP MMC) after it is disabled.

Note 3578900 addresses an insecure deserialization vulnerability in the Live Auction Cockpit of SAP Supplier Relationship Management (SRM). The CVSS score for the vulnerability is rated 10.0. The note also addresses other lower-priority vulnerabilities in SRM including XML External Entity (XXE), Cross-site Scripting (XSS), Open Redirect, and Information Disclosure.

Note 3618955 patches a critical code injection vulnerability in SAP S/4HANA and SAP SCM that could enable attackers to take full control of the SAP solutions through the creation and execution of reports containing malicious code.

Note 3623440 introduces additional authorization checks using object S_RZL_ADM with activity 01 to remove a vulnerability that could lead to an escalation of privileges in SAP NetWeaver AS ABAP.

Note 3623255 applies authorization checks using object SCRMMW for a vulnerable function module that could be exploited to trigger a denial of service in SAP Business Warehouse (BW).

Other important notes include 3565279 which patches older versions of Apache Struts in SAP BusinessObjects Business Intelligence (BOBJ) that are vulnerable to an insecure file operations vulnerability, and 3610591 for a directory traversal vulnerability in SAP NetWeaver Visual Composer.

What’s New in the Cybersecurity Extension for SAP, Version 5.3

Layer Seven on June 25, 2025

The new release of the Cybersecurity Extension for S AP (CES) is in general availability and includes several important enhancements for SAP vulnerability management and threat detection.

Version 5.3 includes patterns for detecting indicators of compromise in the SAP Cloud Connector. The Connector is an agent that links SAP BTP applications with on-premise SAP systems. As a reverse proxy, it enables internal systems to connect securely with BTP services without exposing the systems to direct external access. The new release of CES includes alerts for security-related events in the Cloud Connector including configuration changes, changes to the Administrator account including passwords, changes to connected BTP subaccounts and backend systems, the activation of traces, settings for logging and auditing, role changes, certificates, LDAP, SNC, and other areas. application changes, remote logins, role changes, role grants to users, and cloud transports. The alerts can be integrated with SIEM solutions for centralized monitoring.

The new release also supports concurrent compliance analysis for multiple systems and includes updates for the SAP RISE, SAP Security Baseline and HIPAA frameworks. Mandatory security parameters and hardening requirements for SAP RISE customers were updated by SAP Enterprise Cloud Services (ECS) in June.

Version 5.3 includes the emergency updates that were released earlier for CVE-2025-31324. This includes patterns for the detection of attempted and successful exploitation of the zero-day vulnerability in SAP AS Java.

Extended checks have been introduced for the execution and logging of OS commands performed using the sapxpg program. sapxpg is a program controller that executes external programs and commands from SAP at the OS level.

Finally, version 5.3 includes checks for the discovery of out-of-maintenance software components in SAP solutions. In accordance with the general SAP maintenance strategy, SAP only delivers support package notes for support packages shipped within the last 24 months. This is referred to as the 24-month rule. The rule took effect on June 11 2019 and extended the previous coverage period for support packages from 18 months. There are some exceptions to the rule, including SAP HANA, BW/4HANA, and SAP Kernel. The impact of the rule is that software components patched up to SP levels where the support packages were released more than 24 months ago are not provided with SP fixes to remove low, medium and high severity vulnerabilities discovered internally by SAP. The vulnerabilities can only be addressed by performing an SP upgrade to a support package that is within the 24-month rule.

SAP Security Notes, June 2025

Layer Seven on June 10, 2025

Hot news note 3600840 patches a critical missing authorization check in SAP NetWeaver Application Server ABAP (AS ABAP) that could lead to an escalation of privileges. The vulnerability is due to the failure to check the RFC start authorization S_RFC for transactional (tRFC) and queued RFC (qRFC) calls during the playback of recorded RFCs. It impacts Kernel versions 789, 793, 914 and 915 for AS ABAP. Note 3600840 applies additional authorization checks for tRFC and qRFC calls to address the vulnerability. The note is supported by Knowledge Base Article (KBA) 3601919. According to the KBA, once the note and Kernel patches are applied, the event ID FU6 should be activated in the security audit log. FU6 will capture RFC scenarios that require the additional RFC authorizations. The checks for the authorizations should be activated by setting profile parameter rfc/authCheckInPlayback to 1 after the required user permissions are updated.

Note 3609271 addresses a high-risk information disclosure vulnerability in SAP GRC that could enable attackers to modify system credentials using a SMB Relay Attack. The vulnerability impacts the AC Plugin of SAP GRC.

Note 3606484 provides corrections for SAP Business Warehouse (BW) to prevent attackers from dropping arbitrary SAP tables, resulting in the loss of database records. The corrections remove vulnerable code in the impacted RFC function module.

Note 3610006 patches multiple memory corruption and session management vulnerabilities in the SAP Master Data Management (MDM) Server using randomized session token generation.

Note 3560693 applies input validation to address a stored cross-site scripting vulnerability in BI Workspace within SAP BusinessObjects Business Intelligence.

SAP Vulnerability Actively Exploited by Ransomware Groups and Threat Actors

Layer Seven on May 28, 2025

CVE-2025-31324 for the zero-day vulnerability in SAP NetWeaver was officially added to the Known Exploited Vulnerabilities (KEV) catalog by the United States Cybersecurity and Infrastructure Security Agency (CISA) on April 29. CVE-2025-42999 was also added to the KEV catalog on May 15. Both CVEs address critical vulnerabilities in the Visual Composer framework in SAP NetWeaver Java.

The vulnerabilities were added to the catalog based on evidence of active exploitation by threat actors reported by security researchers. The evidence indicates that exploitation attempts began in February this year. Some organizations have observed successful exploitation from March. On May 8, Forescout reported exploitation attempts for CVE-2025-31324 originating from China. On May 18, ReliaQuest confirmed that the Russian ransomware group BrianLan and another ransomware operator called RansomEXX were actively targeting the vulnerability. According to ReliaQuest, “The involvement of groups like BianLian and RansomEXX reflects the growing interest in weaponizing high-profile vulnerabilities for financial gain. These developments emphasize the urgent need for organizations to immediately apply patches, monitor suspicious activity, and strengthen defenses.”

SAP notes 3594142 and 3604119 and the supporting Knowledge Base Articles (KBAs) provide patches for supported versions of SAP NetWeaver Java. Manual instructions are provided in the notes for unsupported versions. Disabling the Visual Composer or the Development Server application are no longer the recommended solutions. The components should be removed by following the instructions in Option 0 of KBA 3593336.

The Cybersecurity Extension for SAP detects SAP solutions vulnerable to CVE-2025-31324 and CVE-2025-42999. It also detects and alerts for attempted and successful exploitation of the vulnerabilities based on relevant signatures and indicators of compromise.

SAP Security Notes, May 2025

Layer Seven on May 23, 2025

Hot news note 3594142 patches a critical missing authorization check in the development server of Visual Composer within SAP NetWeaver Application Server Java (AS Java). The note addresses CVE-2025-31324, a zero-day vulnerability discovered and reported by ReliaQuest on April 22. The note includes a correction for specific support packages of version 7.50 of AS Java. Workarounds are detailed in the Knowledge Base Article (KBA) 3593336 for earlier versions that are no longer maintained by SAP. The recommended workaround is the complete removal of the Visual Composer Metadata Uploader application using a telnet connection or the NetWeaver Development Studio. An Access Control List (ACL) in the ICM and/or network firewall rules can be applied to limit access to the Visual Composer if the component is required in AS Java systems. The steps are detailed in the KBA.

The corrections for CVE-2025-31324 can also be applied through note 3604119, which addresses a deserialization vulnerability in the Visual Composer. The note should be applied irrespective of the implementation status of note 3594142.

Note 3600859 disables a vulnerable remote-enabled function module in S/4HANA that can be exploited by threat actors to replace SAP programs including standard ABAP programs. The function module is not used by standard SAP processes. Calls to the function module will generate a dump after the correction in the note is applied.

Note 3578900 patches multiple vulnerabilities in SAP Supplier Relationship Management (SRM), including blind XML External Entity (XXE), reflected Cross-Site Scripting (XSS), and information disclosure. The vulnerabilities are due to a deprecated Java Applet used by SRM Live Auction.

Notes 3591978 and 3483344 provide corrections for high-priority missing authorization checks in SAP Landscape Transformation and SAP PDCE, respectively.

SAP Zero Day Vulnerability CVE-2025-31324 / Security Note 3594142

Layer Seven on April 28, 2025

On April 22, ReliaQuest released details of a zero-day vulnerability that the company discovered during investigations into customer incidents involving the upload and execution of malicious files in SAP NetWeaver Java systems. According to the findings of the investigation, threat actors were able to take full control of the target systems by exploiting a vulnerability in the Metadata Uploader endpoint within the Development Server of the Visual Composer component in SAP NetWeaver Java. The exploitation involved specific POST requests that led to the installation of JSP webshell files in the directory j2ee/cluster/apps/sap.com/irj/servletjsp/irj/root/. The webshells enabled threat actors to execute remote commands and obtain full control of SAP systems using the privileges of the SAP operating system user <SID>ADM.

The vulnerability was reported to SAP by ReliaQuest. SAP disclosed the vulnerability as CVE-2025-31324 on April 24 and released a patch in security note 3594142. The CVSS score for the CVE is 10/10 and the security note is rated hot news. The patch applies authentication and authorization to prevent unauthorized access and file upload.

Security note 3594142 provides an automated correction for version 7.50 of the Visual Composer Framework in NetWeaver Java systems. In accordance with the general SAP maintenance strategy, patches are only provided for support packages released within the last 24 months. Please refer to the SAP 24-Month Rule for SAP Security Patching for more information regarding the strategy. Versions 7.0-7.40 of SAP NetWeaver Java are no longer maintained by SAP. Mainstream maintenance for version 7.50 is available until the end of 2027. Extended maintenance will be offered until the end of 2030.

Visual Composer is available in all 7.x versions of SAP NetWeaver Java. Manual instructions are provided for versions lower than 7.50 in KBA 3593336. The recommended solution is to remove the vulnerable component by following the instructions in option 0 of the KBA. If the component is required, you can block access to the Development Server of the Visual Composer using either Access Control Lists (ACLs) defined for the Internet Communication Manager (ICM) or URL restrictions implemented using firewall rules.

Layer Seven Security has released an update for the Cybersecurity Extension for SAP to enable the detection of attempted and successful exploitation of CVE-2025-31324 in SAP NetWeaver Java Systems. This includes POST requests to the vulnerable component and discovering the presence of malicious files in target directories. The solution also checks version information for SAP NetWeaver Java to ensure systems are able to apply automated corrections from SAP rather than manual workarounds.

The 24-Month Rule for SAP Security Patching

Layer Seven on April 24, 2025

Regular patching is critical for protecting SAP software against security vulnerabilities. Security weaknesses are discovered by SAP through internal testing and testing performed by external researchers. The latter disclose vulnerabilities directly to the SAP Product Security Response Team and through the official SAP bug bounty program.

Once a vulnerability is identified or reported, it is validated and reviewed by SAP. Corrective measures can be automated or manual or a combination of both. Corrections are published as SAP security notes on the second Tuesday of each month. SAP provides several tools for discovering, analyzing and implementing required security notes including the SAP Support Portal, Maintenance Planner, System Recommendations, and Note Assistant.

Security notes are rated by SAP based on the severity of each vulnerability. Hot news notes address the most severe vulnerabilities in SAP solutions. Other severities include high, medium and low. SAP also uses the Common Vulnerability Scoring System (CVSS) to rate vulnerabilities. CVSS is a widely used standardized model for assessing vulnerabilities across all software solutions. CVSS scores of 9.0-10.0 and 7.0-8.9 are considered critical and high, respectively. Most vulnerabilities are scored by SAP using CVSS version 3.0. The CVSS score is based on a complex calculation that includes an assessment of multiple factors such as attack complexity, dependencies, user interaction, and the impact to data confidentiality, integrity, and availability. The values used to rate each factor and determine the score are included in the vector string for each vulnerability.

SAP is a CVE Numbering Authority (CNA). Most security notes are assigned a unique CVE and published by SAP in CVE databases. Therefore, SAP vulnerabilities are publicly disclosed even though SAP security notes can only be accessed through the SAP support portal. Some information in security notes is not publicly available. This includes details of workarounds where customers cannot or choose not to implement automated corrections. However, the majority of security notes do not include workarounds. Many older SAP security notes do not include a CVE. SAP became a CVE Numbering Authority in late 2017 and therefore older SAP vulnerabilities are not publicly disclosed.

There are two types of security notes, patch day notes and support package notes. Patch day notes address all vulnerabilities reported by external researchers, regardless of severity, and hot news vulnerabilities discovered internally by SAP with a very high (9.0+) CVSS rating. Support package notes address high, medium and low severity vulnerabilities discovered by SAP. Support package notes are implemented via SP fixes or upgrades. In accordance with the general SAP maintenance strategy, SAP only delivers support package notes for support packages shipped within the last 24 months. This is referred to as the 24-month rule. The rule took effect on June 11 2019 and extended the previous coverage period for support packages from 18 months. The impact of the rule is that software components patched up to SP levels where the support packages were released more than 24 months ago are not provided with SP fixes to remove low, medium and high severity vulnerabilities discovered internally by SAP. The vulnerabilities can only be addressed by performing an SP upgrade to a support package that is within the 24-month rule.

There are some exceptions to the 24-month rule. Some SAP products adhere to a product-specific maintenance strategy rather than the general strategy. This includes products such as SAP HANA, BW/4HANA, and SAP Kernel. The maintenance strategy for each product is documented in specific SAP notes. For example, note 2378962 includes the revision and maintenance strategy for SAP HANA version 2.0. HANA Support Package Stacks (SPS) that are out of maintenance are detailed in the note.

The Cybersecurity Extension for SAP automatically discovers software components with SP levels outside the 24-month rule. It enables customers to track the lifecycle of support packages to ensure software components are patched up to SP levels that are within the SAP maintenance window. Customers are therefore able to apply fixes for all available SAP security notes.

The Cybersecurity Extension for SAP also monitors SAP HANA to identify systems using Support Package Stacks that are out of maintenance, as well as SAP Kernels using outdated Kernel versions.