CVE-2025-42999

CRITICALCVSS 9.1Known Exploited

CISA Known Exploited Vulnerability

SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3604119 ; https://nvd.nist.gov/vuln/detail/CVE-2025-42999

Remediation deadline: June 5, 2025

Ransomware use: Known

Description

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.

Timeline

Published:May 13th, 2025 1:15 AM

Last modified:August 11th, 2026 4:17 AM

Added to KEV:May 15th, 2025

CVSS Scoring

CVSS v3: 9.1 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

sap

Products

netweaver

Weaknesses (CWE)

CWE-502

References & Reports

Advisories, patches, and third-party reports

https://me.sap.com/notes/3604119Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42999US Government Resource

Source: NIST NVD · Data may lag official sources by up to one minute