Actively exploited in the wild
SAP NetWeaver Deserialization Vulnerability
SAP - NetWeaver · Listed in the CISA KEV since 2025-05-15. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-42999
CriticalCVSS 9.1KEVExploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable to insecure deserialization when a privileged user uploads untrusted or malicious content. This could lead to compromise of confidentiality, integrity, and availability of the host system.
Risk Assessment
Compromise of the system can result in data leakage, modification or damage, and service disruption.
Recommendation
Restrict access to the upload functionality to trusted users and apply security updates from SAP.
Other vulnerabilities in SAP NetWeaver Visual Composer
See all- CVE-2026-89110Critical
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system, which depending on the remote connection configuration could lead to full compromise of the remote system.
- CVE-2025-31324CriticalActively exploited
SAP NetWeaver Visual Composer Metadata Uploader is not protected with proper authorization, allowing unauthenticated agents to upload potentially malicious executable binaries that could severely harm the host system. This affects confidentiality, integrity, and availability.
Original NVD description (English source)
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS