CVE-2025-42999 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-05-13

Added to CISA KEV: 2025-05-15 2 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Apply SAP security note 3604119 immediately to patch VCFRAMEWORK 7.50
Audit privileged user accounts with upload permissions to Visual Composer
Monitor metadata upload activities and file deserialization processes
Implement network segmentation to limit access to Visual Composer development servers
Review and restrict privileged access to Visual Composer metadata uploader functionality

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-42999 is a critical security vulnerability affecting the SAP NetWeaver Visual Composer component. Below is a summary of the known details regarding this flaw.

Vulnerability Overview

CVE-2025-42999 is an insecure deserialization vulnerability within the SAP NetWeaver Visual Composer development server ^[1]. It allows a user with specific upload permissions—or in some scenarios, a privileged user—to upload untrusted or malicious content ^[5] ^[4].

Exploitation and Attack Details

Active Exploitation: The vulnerability has been observed being actively exploited in the wild ^[2] ^[3].
Attack Method: Attackers have been known to chain this vulnerability with other flaws, such as the unauthenticated file upload vulnerability CVE-2025-31324, to breach SAP systems ^[2].
Impact: Successful exploitation allows for remote code execution (RCE), enabling attackers to take over the host system, steal sensitive data, or disrupt operations ^[4] ^[2].
Exploit Availability: There have been reports of attackers testing exploits for this vulnerability in the wild, indicating that functional exploit code exists and has been utilized by threat actors ^[3].

Mitigation and Patch Status

Patch Status: SAP has released security patches to address this vulnerability. Organizations using SAP NetWeaver are strongly advised to consult the official SAP Security Patch Day bulletins for 2025 to identify and apply the necessary updates (specifically referencing SAP Security Note 3604119) ^[1].
Mitigation: Beyond applying the official patches, organizations should restrict upload permissions for the Visual Composer component to only trusted, authorized users and monitor for suspicious file upload activity or unauthorized deserialization attempts.

Sources

SAP Security Patch Day Bulletins - 2025 - SAP Support Portal
3604119. [CVE-2025-42999] Insecure Deserialization in SAP NetWeaver (Visual Composer development server) ... Related CVE - CVE-2025-30009, CVE- ...
SAP patches second zero-day flaw exploited in recent attacks
CVE-2025-42999 is a vulnerability in SAP NetWeaver that allows attackers to execute arbitrary commands remotely. It was chained with another unauthenticated file upload flaw (CVE-2025-31324) to breach SAP systems and upload web shells.
Active Exploitation of CVE-2025-31324 and CVE-2025-42999 in the ...
Active exploitation of SAP MetadataUploader flaws CVE-2025-31324 & CVE-2025-42999 shows early attacker testing before public exploits.
CVE-2025-42999 - SAP NetWeaver Visual Composer Metadata Uploader ...
CVE-2025-42999 is a newly discovered vulnerability in SAP NetWeaver Visual Composer (VC). This vulnerability lets a user with upload permissions—sometimes even an internal or privileged user—upload harmful files. When these files are deserialized by the system, an attacker can potentially take over…
CVE-2025-42999 Detail - NVD
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content.