Vulnerability in SAP NetWeaver Visual Composer's Metadata Uploader
CVE-2025-42999
Key Information:
- Vendor
SAP
- Vendor
- CVE Published:
- 13 May 2025
Badges
What is CVE-2025-42999?
A flaw in the SAP NetWeaver Visual Composer’s Metadata Uploader allows privileged users to upload potentially harmful content. When this content is deserialized, it can compromise the confidentiality, integrity, and availability of the host system. This vulnerability highlights the need for stringent input validation and content verification protocols to protect against unauthorized access and system exploitation.
CISA has reported CVE-2025-42999
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2025-42999 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
SAP NetWeaver (Visual Composer development server) VCFRAMEWORK 7.50
News Articles
SAP Flaw Exploited by Ransomware Groups and Chinese-Backed Hackers
The critical vulnerability is being exploited by BianLian, RansomwEXX and a Chinese nation-state actor known as Chaya_004
3 weeks ago
SAP patches second zero-day flaw exploited in recent attacks
SAP has released patches to address a second vulnerability exploited in recent attacks targeting SAP NetWeaver servers as a zero-day.
3 weeks ago
References
EPSS Score
14% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 👾
Exploit known to exist
- 🦅
CISA Reported
- 📰
First article discovered by BleepingComputer
Vulnerability published
Vulnerability Reserved