CVE-2025-42999 SAP NetWeaver
SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.
- CVSS
- not scored
On CISA’s exploited list
SAP NetWeaver Deserialization Vulnerability
- Added
- 2025-05-15
- Federal patch deadline
- 2025-06-05
- Ransomware use
- known