CVE-2025-42999 SAP NetWeaver Deserialization
A privileged user can upload malicious content to the Visual Composer Metadata Uploader, leading to host system compromise via insecure deserialization.
- Exploited in the wild
- Since 15 May 2025
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-42999?
CVE-2025-42999 is a critical unsafe deserialization vulnerability in Sap Netweaver, published on 13 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
Weakness: CWE-502
Which versions are affected by CVE-2025-42999?
It affects 1 product.
Products include Sap Netweaver.
How do I fix CVE-2025-42999?
No fix has been published for CVE-2025-42999 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 5 Jun 2025.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-42999 being exploited?
Yes. Attackers have exploited CVE-2025-42999 in the wild since at least 15 May 2025, including in ransomware campaigns.
Other vulnerabilities in Sap Netweaver
Sources
Also known as GHSA-rgq9-rg7j-xm4x.