CVE-2025-42999

🗓️ 13 May 2025 00:17:43Reported by sapType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 415 Views

CVE-2025-42999: Insecure deserialization in SAP NetWeaver could compromise system security.

Reporter	Title	Published	Views	Family All 26
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver	12 Jan 202617:30	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver	1 May 202518:44	–	githubexploit
attackerkb	CVE-2025-42999	13 May 202500:00	–	attackerkb
Information Security Automation	About Remote Code Execution – SAP NetWeaver (CVE-2025-31324, CVE-2025-42999) vulnerability	17 Sep 202511:16	–	avleonov
BDU FSTEC	The vulnerability of the MetadataUploader function in the Visual Composer tool of the SAP NetWeaver software integration platform allows a hacker to execute arbitrary code.	19 May 202500:00	–	bdu_fstec
Circl	CVE-2025-42999	13 May 202501:32	–	circl
CISA KEV Catalog	SAP NetWeaver Deserialization Vulnerability	15 May 202500:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	15 May 202512:00	–	cisa
CNNVD	SAP NetWeaver Visual Composer Metadata Uploader 安全漏洞	13 May 202500:00	–	cnnvd
CNVD	SAP NetWeaver Visual Composer Metadata Uploader Deserialization Vulnerability	19 May 202500:00	–	cnvd

NVD

Vulners

Node

sap netweaverMatch7.5

[
  {
    "defaultStatus": "unaffected",
    "product": "SAP NetWeaver (Visual Composer development server)",
    "vendor": "SAP_SE",
    "versions": [
      {
        "status": "affected",
        "version": "VCFRAMEWORK 7.50"
      }
    ]
  }
]

Source	Link
me	www.me.sap.com/notes/3604119
url	www.url.sap/sapsecuritypatchday
onapsis	www.onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

11 Aug 2026 04:17Current

8.1High risk

Vulners AI Score8.1

CVSS 3.19.1

EPSS0.13868

SSVC

cve-2025-42999 sap netweaver insecure deserialization security note