CVE-2025-42999
SAP NetWeaver Deserialization Vulnerability
Description
CVE-2025-42999 is a critical-severity deserialization of untrusted data vulnerability in SAP NetWeaver Visual Composer, specifically in the Metadata Uploader component. The flaw allows a privileged authenticated user to upload malicious serialized content that, when processed by the server, leads to arbitrary code execution and complete system compromise. With a CVSS v3.1 base score of 9.1 and the vulnerability being actively exploited in the wild, CVE-2025-42999 represents one of the most dangerous SAP vulnerabilities in recent memory. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 5, 2025, and its EPSS score of 65.71% at the 98th percentile confirms widespread exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | netweaver | 7.5 |
References
- https://me.sap.com/notes/3604119(Permissions Required)
- https://url.sap/sapsecuritypatchday(Vendor Advisory)
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42999(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-42999 is classified under CWE-502, Deserialization of Untrusted Data. In SAP NetWeaver Visual Composer, the Metadata Uploader component deserializes user-supplied content without adequate validation, allowing an attacker to craft malicious serialized payloads (often called "gadget chains") that trigger arbitrary code execution during the deserialization process. This class of vulnerability consistently enables remote code execution and is among the most severe weakness types due to the direct path from user-supplied data to system-level code execution.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2025-42999 carries a CVSS v3.1 base score of 9.1 (Critical) with a network-accessible attack vector (AV:N), low attack complexity (AC:L), high privileges required (PR:H), and no user interaction needed (UI:N). The scope is changed (S:C), meaning the deserialization vulnerability in the Visual Composer component can affect resources beyond its own security context, potentially compromising the entire SAP NetWeaver host and connected SAP systems. Confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H), indicating complete system compromise is achievable. SAP NetWeaver is the foundation for many business-critical SAP applications, making exploitation of this vulnerability particularly devastating. The EPSS score of 65.71% at the 98th percentile places it among the most actively targeted vulnerabilities. Third-party exploitation research from Onapsis documents active exploitation campaigns targeting SAP NetWeaver installations.
Exploit Maturity
CVE-2025-42999 demonstrates very high exploit maturity. CISA has confirmed active exploitation in the wild by adding it to the Known Exploited Vulnerabilities catalog. Public exploit information is available via Onapsis research, which documents active exploitation campaigns targeting SAP NetWeaver, including techniques related to this deserialization vulnerability. The EPSS score of 65.71% at the 98th percentile indicates widespread exploitation activity. SAP NetWeaver installations have become prime targets for threat actors due to the high-value business data they process, and deserialization vulnerabilities provide a reliable path to remote code execution. While CISA classifies the ransomware association as unknown for this CVE, the complete system compromise achievable through deserialization attacks aligns with the capabilities needed for data exfiltration and ransomware deployment.
Remediation
- Apply SAP security patches immediately. Install the fix documented in SAP Security Note 3604119 for NetWeaver version 7.5. Review the SAP Security Patch Day for the latest guidance and any additional patches.
- Disable or restrict Visual Composer Metadata Uploader. If the Visual Composer component is not required for business operations, disable it entirely. If it must remain active, restrict access to the Metadata Uploader endpoint to only trusted administrative networks.
- Implement deserialization protections. Deploy Java deserialization filters or serialization firewalls that restrict which classes can be instantiated during deserialization. Configure allowlists of permitted classes for the SAP Java application server.
- Conduct forensic investigation. Examine SAP NetWeaver application logs for unusual upload activity to the Visual Composer Metadata Uploader. Check for indicators of compromise including unauthorized file uploads, unexpected Java class loading, new administrative users, or evidence of webshell deployment.
- Implement network segmentation and monitoring. Isolate SAP NetWeaver servers from direct internet access. Deploy web application firewall rules to inspect and filter serialized content in upload requests. Monitor for outbound connections from the SAP server to unknown external hosts.
Technical Details
CVE-2025-42999 is a deserialization of untrusted data vulnerability in the SAP NetWeaver Visual Composer Metadata Uploader. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H indicates a network-accessible attack requiring high privileges but low complexity, with changed scope and maximum impact across all CIA dimensions.
The vulnerability exists in how the Metadata Uploader processes uploaded content. When a privileged user submits content through the upload functionality, the server deserializes the data without sufficient validation of the object types being reconstructed. An attacker can craft a malicious serialized payload containing a chain of Java objects (a "gadget chain") that, when deserialized, trigger a sequence of method calls culminating in arbitrary code execution. This is a classic CWE-502 pattern exploiting Java's native serialization mechanism, where object reconstruction can invoke constructors, readObject() methods, and finalizers that an attacker can weaponize. The changed scope reflects that code execution on the NetWeaver application server typically grants access to the underlying operating system and connected SAP backend systems.
Frequently Asked Questions
Is CVE-2025-42999 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-42999 to the KEV catalog. Onapsis research documents active exploitation campaigns targeting SAP NetWeaver installations. The EPSS score of 65.71% at the 98th percentile confirms widespread exploitation.
What products are affected by CVE-2025-42999?
SAP NetWeaver version 7.5 is confirmed affected. The vulnerability specifically resides in the Visual Composer Metadata Uploader component. Organizations running SAP NetWeaver with Visual Composer should apply patches immediately.
How do I fix CVE-2025-42999?
Apply SAP Security Note 3604119 and review the SAP Security Patch Day for the latest updates. If Visual Composer is not needed, disable it entirely. Implement deserialization class filtering and restrict network access to the Metadata Uploader endpoint.
How severe is CVE-2025-42999?
CVE-2025-42999 has a CVSS v3.1 base score of 9.1 (Critical) with maximum impact on confidentiality, integrity, and availability. The changed scope means exploitation can compromise the entire SAP NetWeaver host and connected systems. The EPSS score of 65.71% at the 98th percentile indicates this is one of the most actively exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.