SAP deserialization vulnerabilities Separately, researchers at Onapsis said SAP issued a record number of patches, including one for CVE-2025-30012, which has a CVSS severity score of 10.