CVE-2025-42999: SAP NetWeaver Visual Composer deserialization, exploited in the wild
The short version: SAP NetWeaver's Visual Composer Metadata Uploader has an insecure-deserialization flaw (CVE-2025-42999): content uploaded by a privileged user is deserialized unsafely, compromising the host's confidentiality, integrity, and availability. On its own it needs privilege — but in the real world it was chained with a companion unauthenticated upload flaw (CVE-2025-31324) and used to compromise internet-facing SAP systems. It's in CISA's KEV catalog. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — in practice, via the exploited chain (see below) |
| CVSS v3.1 (NVD) | 9.1 — Critical · AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 12.52% · 96th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation due 2025-06-05 (added 2025-05-15) |
| Known exploited? | Yes — exploited in the wild, chained with CVE-2025-31324 |
| Vulnerability type | CWE-502 deserialization of untrusted data → compromise of host confidentiality, integrity, availability |
| Requires authenticated session? | Yes for this flaw alone (privileged user); the exploited chain begins unauthenticated via CVE-2025-31324 |
| Affected | SAP NetWeaver Visual Composer (VCFRAMEWORK 7.50) |
| Fixed in | Per SAP Security Note 3604119 — apply the May 2025 SAP Security Patch Day fixes |
What you need to know
Visual Composer's Metadata Uploader accepts content and deserializes it. When that deserialization isn't safely constrained, crafted content becomes attacker-controlled objects and, from there, code execution on the SAP host. Read in isolation, CVE-2025-42999 requires a privileged user (its PR:H vector) — which is why its base score, while high, isn't a perfect 10.
The real-world picture is worse, and it's the reason this is a KEV entry. Attackers paired it with CVE-2025-31324, a missing-authorization flaw in the same Visual Composer upload path that lets an unauthenticated attacker upload files. Chained, the two remove the privilege precondition entirely: unauthenticated upload plus unsafe deserialization equals remote code execution on internet-facing SAP NetWeaver, and that combination was used against real targets.
- It's a crown-jewel system. SAP NetWeaver underpins core business processes; a compromise here is not a peripheral one.
- The base score undersells the chain. The
PR:Hon this CVE evaporates once it's paired with the unauthenticated upload bug.
How serious we see it
Moderate — in practice.
Taken alone, 9.1 with a privilege requirement might read as "serious but gated." Taken as it was actually used — chained with CVE-2025-31324 for unauthenticated RCE against internet-facing SAP, and listed in KEV — it belongs at the top of the queue. We rate by what it does in the wild, not by the single-CVE vector. The bounded, reassuring part: SAP published fixes, the affected component is specific, and you can determine exposure. As with any exploited-before-you-patched flaw, patched and clean are separate questions.
Recommendations
Straight from SAP's guidance and CISA:
- Patch now. Apply SAP's fixes from Security Note 3604119 (May 2025 Security Patch Day), and ensure the companion fix for CVE-2025-31324 is applied in the same maintenance.
- Restrict or disable Visual Composer. If you don't need Visual Composer, disable it; otherwise limit who can reach the upload endpoints.
- Hunt for compromise. Review the SAP host and web directories for unexpected files, web shells (JSP/other), and anomalous uploads around the exposure window.
- If you find indicators, respond. Rotate credentials and keys, investigate for lateral movement, and rebuild where integrity is in doubt.
- Confirm your exposure first. Verify whether you run NetWeaver with Visual Composer, and whether it's internet-facing.
How BreachRisk sees it
BreachRisk discovers internet-facing SAP NetWeaver instances from little more than your domain, fingerprints the product, and flags exposure tied to this KEV-listed, actively exploited flaw — raised to the top of your results because it's in KEV and because our severity take reflects the exploited chain, not the single-CVE vector. We detect and flag the exposed, affected system; we don't need a privileged account to tell you it's there and reachable.
That outside-in, continuous view is precisely what you want for a business-critical platform under active attack: the exposed NetWeaver is already mapped, so you can go straight to patch-and-verify.