CVE-2025-42999

The vulnerability (CWE-502 — deserialization of untrusted data) consists of the fact that the metadata transmission mechanism in Visual Composer does not sufficiently verify uploaded data before deserialization. A privileged user can upload a specially crafted file or data that will be executed by the application as code during the deserialization process. This leads to the execution of untrusted code on the SAP NetWeaver application server side.

An attacker can gain full access to sensitive data (confidentiality breach), modify or delete system data (integrity breach), and cause system unavailability (availability breach), including potential takeover of the entire host system.

Patches available from the vendor must be applied immediately in accordance with SAP Note 3604119 and recommendations published as part of the SAP Security Patch Day. Due to active exploitation of the vulnerability, patch deployment should be treated as a priority.

SAP NetWeaver with the Visual Composer Metadata Uploader component — specific versions indicated in vendor references (SAP Note 3604119).

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.