CVE-2025-42999 — SAP NetWeaver Deserialization Vulnerability
CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability
CISA Known Exploited Vulnerability (KEV)
| Vendor / project | SAP |
| Product | NetWeaver |
| Date added | 2025-05-15 |
| Due date | 2025-06-05 |
| Ransomware campaign use | Known |
Description
SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.
Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3604119 ; https://nvd.nist.gov/vuln/detail/CVE-2025-42999
References
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-42999
- KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog