Pakistani Companies Face Massive Cybersecurity Threat as Critical SAP Flaw Exploited Worldwide

Pakistan’s corporate and government sectors are facing an urgent cybersecurity threat after a critical vulnerability in SAP S/4HANA, one of the world’s most widely used enterprise resource planning (ERP) systems, was disclosed. Cybersecurity experts warn that if left unpatched, this flaw could lead to devastating attacks, including data theft, ransomware deployment, and complete system takeovers of business-critical infrastructure.

The vulnerability, identified as CVE-2025-42957, has been given a severity score of 9.9 out of 10, placing it in the highest risk category. According to a recent National CERT (NCA) advisory, the flaw is already being actively exploited by hackers, putting Pakistani financial institutions, telecom operators, government agencies, and large enterprises at imminent risk.

How the Vulnerability Works and Its Impact

The flaw originates from insufficient input validation in SAP’s Remote Function Call (RFC) module, a core system used to connect different SAP components across networks. With only low-level stolen credentials, such as those acquired through phishing, attackers can remotely inject malicious code without any user interaction.

This enables cybercriminals to silently compromise SAP systems, bypassing many traditional defenses. Once inside, they can take full control of an organization’s SAP environment, steal sensitive data, deploy ransomware, or disrupt essential services.

Given the widespread use of SAP in Pakistan’s banking, telecom, manufacturing, and government sectors, experts warn that successful attacks could cripple key parts of the country’s digital economy. The advisory confirmed that unpatched versions of S/4HANA and related products, including certain releases of NetWeaver Application Server ABAP and SAP Business One, are vulnerable and must be patched immediately.

Urgent Recommendations and National Response

The National CERT has urged organizations to apply SAP’s September 2025 security updates without delay, prioritizing internet-facing and mission-critical systems. Until patches are applied, companies are advised to limit access to vulnerable SAP components by restricting them to trusted internal networks.

Continuous monitoring of network logs and RFC activity is also critical to detect early signs of exploitation. Security teams are being advised to prepare incident response plans and ensure data backups are secure and readily available.

Unlike many software flaws, this vulnerability requires minimal effort to exploit and no user interaction, making it a high-value target for both cybercriminal gangs and state-sponsored attackers. Experts warn that failure to act could result in widespread operational disruptions and significant economic losses for Pakistan.

“Timely patching is critical to prevent a full compromise of business-critical SAP environments,” the advisory stated, highlighting the urgency of immediate action.

Pakistan’s businesses and government agencies now face a race against time to secure their systems before the flaw is exploited on a broader scale. Global advisories have been issued, but Pakistan remains particularly vulnerable due to limited cybersecurity budgets, reliance on outsourced IT services, and the absence of strict compliance frameworks for SAP systems.

The National CERT continues to urge all organizations to patch now, monitor continuously, and prepare for worst-case scenarios, emphasizing that the window for prevention is closing rapidly.