Skip to main content

Netweaver CVE-2025-42999

CRITICAL
Deserialization of Untrusted Data (CWE-502)
2025-05-13 cna@sap.com
Deserialization SAP Netweaver
9.1
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 28, 2026 - 18:41 vuln.today
Added to CISA KEV
Oct 31, 2025 - 21:58 cisa
CISA KEV
PoC Detected
Oct 31, 2025 - 21:58 vuln.today
Public exploit code
CVE Published
May 13, 2025 - 01:15 nvd
CRITICAL 9.1

DescriptionNVD

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

AnalysisAI

SAP NetWeaver Visual Composer allows privileged users to upload untrusted content that is deserialized on the server, enabling remote code execution. Companion to CVE-2025-31324.

Technical ContextAI

The CWE-502 deserialization processes uploaded content from privileged users through the Metadata Uploader. Combined with CVE-2025-31324 (unauthenticated upload), this provides a complete exploitation chain for arbitrary code execution.

RemediationAI

Apply SAP security notes for both CVE-2025-31324 and CVE-2025-42999. Disable Visual Composer. Review SAP servers for indicators of compromise.

Share

CVE-2025-42999 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy