SAP NetWeaver Visual Composer vulnerabilities
3 known CVE vulnerabilities in SAP NetWeaver Visual Composer, translated and rated.
- CVE-2026-89110Critical
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system, which depending on the remote connection configuration could lead to full compromise of the remote system.
- CVE-2025-42999CriticalActively exploited
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable to insecure deserialization when a privileged user uploads untrusted or malicious content. This could lead to compromise of confidentiality, integrity, and availability of the host system.
- CVE-2025-31324CriticalActively exploited
SAP NetWeaver Visual Composer Metadata Uploader is not protected with proper authorization, allowing unauthenticated agents to upload potentially malicious executable binaries that could severely harm the host system. This affects confidentiality, integrity, and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS