VULNERABILITY INTELLIGENCE

CVE-2025-42999

CVSS score9.1 CRITICAL
EPSS probability12.85%
CISA KEVKnown exploited vulnerability
Published2025-05-13
Last modified2026-08-11
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Known Exploited Vulnerability

SAP NetWeaver Deserialization Vulnerability

Vendor / product: SAP / NetWeaver

Description

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

Weakness classification

  • cna@sap.com: CWE-502

Primary references