CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability

CVE-2025-42999 is a deserialization vulnerability in SAP NetWeaver, specifically involving the Visual Composer Metadata Uploader. It allows a privileged attacker to deserialize untrusted or malicious content, which can compromise the confidentiality, integrity, and availability of the host system. For IT and security teams running SAP environments, this matters because NetWeaver often sits at the core of enterprise business processes; successful abuse can give an attacker a foothold to disrupt operations or move laterally.

Public detail is limited to the CISA summary and the CWE classification. Confirm all version, patch, and configuration specifics against the vendor advisory before acting.

How it works

The weakness is CWE-502: deserialization of untrusted data. In this class of flaw, an application accepts serialized objects or metadata and reconstructs them in memory without sufficient validation. When the reconstructed content contains attacker-controlled code or object graphs, the runtime can execute unintended logic under the privileges of the process performing the deserialization.

According to the CISA summary, a privileged attacker targets the Visual Composer Metadata Uploader component of SAP NetWeaver. By supplying malicious content that the uploader then deserializes, the attacker can achieve compromise of the host system. Exact exploit mechanics, payload formats, or required authentication steps are not provided in the available facts; treat any public proof-of-concept claims with caution and verify against the official SAP advisory.

Am I affected? How to find it in your systems

SAP NetWeaver is typically deployed as the application server foundation for SAP ERP, CRM, and related business suites. It may run on-premises, in private clouds, or as part of managed SAP landscapes. Visual Composer is a development and modeling tool whose Metadata Uploader handles import of model definitions and related artifacts.

• Inventory all SAP NetWeaver instances, including development, test, and production systems. Use SAP Solution Manager, landscape management tools, or host-based package inventories to locate NetWeaver installations.
• Identify whether Visual Composer and its Metadata Uploader are installed or enabled. Check component lists and configuration settings for Visual Composer-related services.
• Compare installed software components and support package levels against the versions listed in the vendor advisory for CVE-2025-42999. Exact affected versions are not stated in the supplied facts; confirm them directly with SAP.
• Review application and security logs for unusual Metadata Uploader activity, unexpected deserialization errors, or privilege-escalation indicators around the time of any suspicious uploads. Telemetry from endpoint detection tools watching the NetWeaver process can also surface anomalous child processes or network connections.

How to remediate

Patch first. Apply the vendor-supplied update or support package that addresses CVE-2025-42999 exactly as described in the official SAP security note or advisory. Follow SAP’s recommended deployment sequence for NetWeaver landscapes so that development and quality systems are validated before production.

• After patching, verify that the Visual Composer Metadata Uploader no longer accepts or processes the previously vulnerable content types.
• For this class of deserialization flaw, restrict the set of classes or object graphs that can be reconstructed, enforce strict input validation on all uploaded metadata, and run the uploader under the least privilege necessary.
• Harden the surrounding NetWeaver configuration: disable unused Visual Composer features, enforce strong authentication and authorization for any upload interfaces, and keep the Java or ABAP runtime fully patched.
• Follow the CISA required action: apply mitigations per vendor instructions, adhere to BOD 22-01 guidance where cloud services are involved, or discontinue use of the product if mitigations cannot be applied.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls appropriate to a privileged deserialization vulnerability.

• Segment NetWeaver hosts so that only authorized administrative networks can reach the Visual Composer Metadata Uploader interfaces. Block direct internet access to these endpoints.
• If a web application firewall or reverse proxy sits in front of the uploader, apply virtual-patching rules that reject unexpected content types or oversized metadata payloads. Confirm rule efficacy against the vendor’s description of the attack surface.
• Temporarily disable the Metadata Uploader or the entire Visual Composer component if business processes allow it. Document the change and re-enable only after patching.
• Increase monitoring: alert on any upload activity, deserialization exceptions, or process creation events originating from the NetWeaver service account. Retain logs for forensic review.
• Enforce multi-factor authentication and just-in-time access for any accounts that retain privileges to the uploader.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to full host compromise and subsequent data breaches. Known ransomware use of CVE-2025-42999 is not documented in the available facts. If you suspect exploitation, isolate the affected systems, preserve logs and memory images, and begin incident-response procedures. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to see whether credentials or personal information have already appeared in public dumps.