What is the CVSS score of CVE-2025-42999?

CVE-2025-42999 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 67.8%.

Which versions of Netweaver are affected by CVE-2025-42999?

Organizations using SAP NetWeaver Visual Composer Metadata Uploader face critical risk from CVE-2025-42999, a insecure deserialization vulnerability rated CVSS 9.1.

Is there a public PoC exploit available for CVE-2025-42999?

Yes, a public proof-of-concept exploit is available for CVE-2025-42999. Prioritise patching immediately. EPSS: 67.8%.

How to fix or mitigate CVE-2025-42999?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Netweaver CVE-2025-42999

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-05-13 cna@sap.com

SAP Deserialization Netweaver

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:41 vuln.today

Added to CISA KEV

Oct 31, 2025 - 21:58 cisa

CISA KEV

PoC Detected

Oct 31, 2025 - 21:58 vuln.today

Public exploit code

CVE Published

May 13, 2025 - 01:15 nvd

CRITICAL 9.1

DescriptionCVE.org

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

AnalysisAI

SAP NetWeaver Visual Composer allows privileged users to upload untrusted content that is deserialized on the server, enabling remote code execution. Companion to CVE-2025-31324.

Technical ContextAI

The CWE-502 deserialization processes uploaded content from privileged users through the Metadata Uploader. Combined with CVE-2025-31324 (unauthenticated upload), this provides a complete exploitation chain for arbitrary code execution.