DEV Community

Cover image for CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability
Freedom Coder
Freedom Coder

Posted on • Originally published at scyscan.com

CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability

CVE ID

CVE-2025-42999

Vulnerability Name

SAP NetWeaver Deserialization Vulnerability

  • Project: SAP
  • Product: NetWeaver

Date

  • Date Added: 2025-05-15
  • Due Date: 2025-06-05

Description

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3604119 ; https://nvd.nist.gov/vuln/detail/CVE-2025-42999

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

Top comments (0)