CVE-2025-42999criticalunder attackransomwareCWE-502

CVE-2025-42999: critical vulnerability in SAP_SE SAP NetWeaver (Visual Composer…

Insecure Deserialization in SAP NetWeaver (Visual Composer development server)

Published · Updated

Follow this CVE+ Monitor SAP NetWeaver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.1epss 13%
from disclosure to weapon
Published on NVDMay 13
CISA KEV+2d
Action required by CISAfederal deadline: 2025-06-05

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

SAP NetWeaver's Visual Composer allows an attacker with upload privileges to inject malicious code through insecure deserialization, which runs automatically when the system processes the uploaded file and could compromise the entire server.

Technical detail

CWE-502 insecure deserialization in SAP NetWeaver Visual Composer Metadata Uploader permits authenticated users to upload crafted serialized objects that execute arbitrary code upon deserialization, requiring elevated privileges but resulting in full system compromise (confidentiality, integrity, availability impact).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
SAP_SE · SAP NetWeaver (Visual Composer development server)
Related CVEs — SAP_SE SAP NetWeaver (Visual Composer…

In the same product, most dangerous first.

CVE-2025-31324CRITICALMissing Authorization check in SAP NetWeaver (Visual Composer development server)EPSS 99.5%KEV