Vulnerability in SAP NetWeaver Visual Composer's Metadata Uploader
CVE-2025-42999

9.1CRITICAL

Key Information:

Vendor

SAP
Status
SAP Netweaver (visual Composer Development Server)
Vendor
CVE Published:
13 May 2025

Badges

👾 Exploit Exists🟣 EPSS 18%🦅 CISA Reported📰 News Worthy

What is CVE-2025-42999?

A flaw in the SAP NetWeaver Visual Composer’s Metadata Uploader allows privileged users to upload potentially harmful content. When this content is deserialized, it can compromise the confidentiality, integrity, and availability of the host system. This vulnerability highlights the need for stringent input validation and content verification protocols to protect against unauthorized access and system exploitation.

CISA has reported CVE-2025-42999

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2025-42999 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

SAP NetWeaver (Visual Composer development server) VCFRAMEWORK 7.50

News Articles

favicon imageInfosecurity Magazine

SAP Flaw Exploited by Ransomware Groups and Chinese-Backed Hackers

The critical vulnerability is being exploited by BianLian, RansomwEXX and a Chinese nation-state actor known as Chaya_004

favicon imageSC Media

SAP NetWeaver flaw exploited by ransomware groups BianLian, RansomEXX

A second zero-day flaw was found in addition to exploitation of Netweaver by ransomware groups.

favicon imageBleepingComputer

SAP patches second zero-day flaw exploited in recent attacks

SAP has released patches to address a second vulnerability exploited in recent attacks targeting SAP NetWeaver servers as a zero-day.

References

https://me.sap.com/notes/3604119
https://url.sap/sapsecuritypatchday

EPSS Score

18% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by BleepingComputer

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-42999 : Vulnerability in SAP NetWeaver Visual Composer's Metadata Uploader