BlackTreeCVE Intelligence
January 2025 Patch Tuesday3537476Normal patch window

SAP · 3537476

Assess and apply SAP security advisory 3537476

SAP lists 3537476 in its 2025-01 Security Patch Day release for SAP NetWeaver Application Server for ABAP and ABAP Platform, Versions – KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 7.97, 8.04, 9.12, 9.13, 9.14. The public bulletin links 1 CVE; entitled SAP Note content remains the deployment authority.

Product
SAP NetWeaver Application Server for ABAP and ABAP Platform, Versions – KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 7.97, 8.04, 9.12, 9.13, 9.14
Release
s – KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 7.97, 8.04, 9.12, 9.13, 9.14
Published
2025-01-14
Updated
2025-01-14
Cycle
January 2025 Patch Tuesday
Normal patch windowBlackTree recommended timingmedium confidence
1Vendor-linked CVEsComplete For Public Bulletin
1Preserved revisionsCanonical history remains visible
0Known issuesVendor-documented context only

Action and evidence

Operational decision

Action type
Deploy Patch
Platform
SAP
Restart
unknown
Vendor signal
Critical; CVSS 9.9

Why this urgency

  • Fix Available
  • Routine Review

Evidence signals kept separate

CISA KEV
Unknown
Confirmed exploitation
Not Stated
Vendor exploitability
Not stated in the reviewed source
Maximum CVSS
9.9 (CVSS 3.1, CVE-2025-0070)
Maximum EPSS
Not loaded for this patch record
Normal patch window

BlackTree recommends the normal approved patch window. No accepted exploitation or emergency signal currently justifies an out-of-band change by itself.

BlackTree urgency is an operational review window. It does not replace vendor severity or CVSS.

Environment override questions

  • Is SAP NetWeaver Application Server for ABAP and ABAP Platform, Versions – KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 7.97, 8.04, 9.12, 9.13, 9.14 exposed to untrusted networks or content?
  • Does this update affect an identity, management, backup or other control-plane system?
  • Are compensating controls tested and monitored until the selected patch window?

Deployment context

Effects and caveats

  • Confirm the installed SAP component and version before applying the correction.
  • Use entitled SAP Note content for prerequisites, correction instructions and rollback planning.

Known data gaps

  • Authenticated SAP correction content is not copied into the public catalogue.
  • Restart and downtime requirements require review of the entitled SAP Note.

Deployment plan

Guidance basis: Mixed

Prerequisites

  • Confirm the affected product, edition, architecture and current build before deployment.

Sequencing

  • Review the entitled SAP Note and apply prerequisites in the vendor-stated order.

Downtime

Downtime and restart impact are not fully stated in the reviewed public source.

Rollback and recovery

  • Capture the current version and a recoverable backup or snapshot before the change.
  • Use the vendor-supported uninstall or recovery path when one is available.

Workarounds

  • No vendor workaround is asserted unless it appears in the official advisory.

Vulnerability relationships

Vendor-linked CVEs

The complete CVE relationship set is not available in this bounded record.

Linked CVEs
1
Confirmed exploited
0
PoC or lab evidence
0
Maximum CVSS
9.9
Open linked CVE review

Provenance

Field verification

  • Note_identity_product_and_versionssap-patch-day/tableVerified Automatic · Retrieved 26 Aug 2026, 11:55 UTC
  • Cve_relationships_and_vendor_signalsap-patch-day/tableVerified Automatic · Retrieved 26 Aug 2026, 11:55 UTC
Open official vendor source

Revision history

Canonical record changes

  1. Revision 12025-01-14

    Captured from the scheduled SAP Security Patch Day bulletin.

Publication review

The note identity, Patch Day inclusion, product, public version expression, vendor priority, CVSS and public CVE relationships were generated from the official SAP Patch Day table and passed structural validation. The project owner approved automatic Patch Tuesday publication. Each published record passed its own official-source completeness gate. Pending sources expose readiness only and prior approved records are retained on refresh failure.