Actively exploited in the wild
SAP NetWeaver Deserialization Vulnerability
SAP - NetWeaver · Listed in the CISA KEV since 2025-05-15. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-42999
CriticalCVSS 9.1KEVExploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable to insecure deserialization when a privileged user uploads untrusted or malicious content. This could lead to compromise of confidentiality, integrity, and availability of the host system.
Risk Assessment
Compromise of the system can result in data leakage, modification or damage, and service disruption.
Recommendation
Restrict access to the upload functionality to trusted users and apply security updates from SAP.
Original NVD description (English source)
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.