CVE ID
CVE-2025-42999
Vulnerability Name
SAP NetWeaver Deserialization Vulnerability
- Project: SAP
- Product: NetWeaver
Date
- Date Added: 2025-05-15
- Due Date: 2025-06-05
Description
SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.
Known To Be Used in Ransomware Campaigns?
Unknown
Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Additional Notes
SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3604119 ; https://nvd.nist.gov/vuln/detail/CVE-2025-42999
Related Security News
- Exploit for critical SAP Netweaver flaws released (CVE-2025-31324, CVE-2025-42999)
- Public Exploit for Chained SAP Flaws Exposes Unpatched Systems to Remote Code Execution
Top comments (0)