CVE-2025-30012 is a critical (CVSS 10.0) insecure deserialization flaw in the Live Auction Cockpit of SAP Supplier Relationship Management. The record says an unauthenticated attacker can cause OS command execution as the SAP administrator. SAP Note 3578900 describes the fix.
What's affected
The record lists SAP Supplier Relationship Management (SRM), specifically the Live Auction Cockpit, which uses a deprecated Java applet component.
The record points to SAP Note 3578900 and the SAP Security Patch Day page. I could not open them because SAP notes need an account, so I cannot list affected releases or fixed support packages. Read the note and follow it.
The record does not flag the CVE as known exploited (not in the CISA KEV catalog at the time of writing).
How to check if you're exposed
Start by finding out whether the Live Auction Cockpit is used at all.
- Ask your SAP Basis team whether SRM is installed, and whether the Live Auction Cockpit is active.
- Check the release and support package level against SAP Note 3578900, which you can open in the SAP for Me portal.
- Review web access to the SRM servlet. If the cockpit is reachable from the internet, treat that as urgent.
Look in SAP and operating system logs for unexpected commands run under the SAP administrator account.
What to do now
- Open SAP Note 3578900 and confirm affected releases and the correction.
- Apply the correction through your SAP patching process, starting with internet facing systems.
- If you do not use the Live Auction Cockpit, ask whether it can be disabled or removed, as the note describes.
- Restrict network access to SRM so it is not reachable from the internet unless required.
- Review logs for signs of misuse, especially commands run as the SAP administrator.
Why it matters
The record maps the flaw to CWE-502 (Deserialization of Untrusted Data). The application accepts a request in a particular encoding and decodes it into objects without limiting which objects can be built. The decoding step itself can then trigger actions the developers did not intend.
The impact stated in the record is execution of operating system commands as the SAP administrator. That account typically has wide reach inside the SAP system, so a successful attack would touch confidentiality, integrity and availability, as the record states. The 10.0 score also reflects that no login is needed.
A deprecated component is a reminder that old features keep carrying risk. If a function is no longer in use, removing it is cheaper than patching it repeatedly.
Quick check
Why is a deprecated applet still a problem?
Old components remain installed and reachable, and a server side servlet may still decode requests even when the applet is no longer used.
Where do I get the fix?
SAP Note 3578900, available through the SAP for Me portal. Follow the instructions in it.
Sources
Last reviewed: 19 October 2026.
