Overview
On April 8, 2025, SAP disclosed a critical vulnerability identified as CVE-2025-30016 in its Financial Consolidation software (version FINANCE 1010). This flaw allows an unauthenticated attacker to gain unauthorized access to the Admin account, compromising the entire system’s security posture.
Technical Details
The vulnerability stems from improper authentication mechanisms within SAP Financial Consolidation. Specifically, the system fails to adequately enforce authentication controls, enabling attackers on the network to bypass security and access high-privilege functionality.
This issue is classified under CWE-921: Storage of Sensitive Data in a Mechanism without Access Control. It implies that sensitive data, such as admin credentials or access tokens, might be exposed or improperly protected, thereby increasing the risk of exploitation.
CVSS Score and Impact
The vulnerability has received a CVSS v3.1 base score of 9.8, reflecting its severity and ease of exploitation. The vector string is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
This score indicates:
- Attack is remotely exploitable over a network (AV:N)
- Low attack complexity (AC:L)
- No privileges required (PR:N)
- No user interaction needed (UI:N)
- High impact on confidentiality, integrity, and availability (C:H/I:H/A:H)
Impacted Software
The affected product is SAP Financial Consolidation FINANCE 1010. All deployments running this version should be considered at risk. This vulnerability is critical for enterprises relying on this software for financial reporting and data management.
Mitigation and Advisory
SAP has issued an advisory and relevant security patches. Organizations using SAP Financial Consolidation should immediately review the following resources:
Although there is no known exploitation in the wild, CISA’s SSVC (Stakeholder-Specific Vulnerability Categorization) marks the technical impact as total and the vulnerability as automatable — indicating a high potential risk if not mitigated.
Conclusion
CVE-2025-30016 presents a serious security risk to organizations using SAP Financial Consolidation. With unauthenticated remote access to administrative functions, attackers could cause severe data breaches or system outages. Immediate patching and system audits are strongly advised.