CVE-2025-42999

CriticalCVSS 9.1/10Known exploited (CISA KEV)Last modified Aug 11, 2026

Description

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver (Visual Composer development server)	VCFRAMEWORK 7.50

References

https://me.sap.com/notes/3604119Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42999US Government Resource

Timeline

Published: May 13, 2025
Last modified: Aug 11, 2026
Added to CISA KEV: May 15, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-43009.8A vulnerability classified as critical has been found in itsourcecode Content Management System 1.0. Affected is an unknown function of the CVE-2025-430007.9Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This CVE-2025-430016.9SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or pr CVE-2025-430024.3SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. Th CVE-2025-430036.4SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI CVE-2025-430045.3Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to a CVE-2025-430054.3SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store use CVE-2025-430066.1SAP Supplier Relationship Management (Master Data Management Catalogue) allows an unauthenticated attacker to execute malicious scripts in t CVE-2025-430076.3SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escala CVE-2025-430085.8Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data CVE-2025-430096.3SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escala CVE-2025-43019.8A vulnerability classified as critical was found in itsourcecode Content Management System 1.0. Affected by this vulnerability is an unknown