Paper/Archive/CVE-2025-42999

CVE-2025-42999

SAP_SE SAP NetWeaver (Visual Composer development server) — Insecure Deserialization in SAP NetWeaver (Visual Composer development server)

KEV · due 5 Jun ransomware use EPSS 13%public exploit SSVC act CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 In CISA KEV+3030.0 EPSS percentile 96.3.963 × 2019.3 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

Affected

ProductAffectedFixed inSource

SAP NetWeaver (Visual Composer development server)VCFRAMEWORK 7.50–CNA

Scores by source

sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3604119 refurl.sap/sapsecuritypatchday refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42999 refonapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324 kevcisa.gov/known-exploited-vulnerabilities-catalog