Historical catalog analysis: CISA added this entry on May 15, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2025-42999 is a deserialization vulnerability (CWE-502) located within the SAP NetWeaver Visual Composer Metadata Uploader. The flaw allows an attacker with privileged access to process untrusted or malicious content, which could lead to a compromise of the host system’s confidentiality, integrity, and availability.
Exposure and applicability
This vulnerability specifically affects environments utilizing the Visual Composer Metadata Uploader component of SAP NetWeaver. It is not applicable to all SAP NetWeaver installations, only those where this specific uploader is deployed. A critical factor for exposure management is that exploitation requires the attacker to already possess privileged credentials; it is not reported as an unauthenticated entry point.
Potential breach-prevention strategy
The source reports that this vulnerability has been utilized in known ransomware campaigns. The reported entry path involves a privileged attacker leveraging the deserialization flaw to compromise the host system. It remains unknown how the initial privileged access was obtained prior to the exploitation of CVE-2025-42999.
Our analysis suggests the following prioritized actions to reduce the likelihood of a similar occurrence:
- Privileged Access Review: Since the vulnerability requires privileges, auditing and restricting administrative accounts could have reduced the pool of potential attackers. Responsible Role: IAM Lead/Security Administrator. Verification: Audit logs showing a reduction in over-privileged accounts.
- Network Segmentation: Isolating SAP NetWeaver components from general user segments could limit the ability of a compromised privileged account to reach the Metadata Uploader. Responsible Role: Network Architect. Verification: Firewall rule validation and connectivity tests between zones.
- Egress Filtering: Implementing strict egress controls on the host system could have limited the ability of ransomware to communicate with command-and-control servers after initial compromise. Responsible Role: Infrastructure Lead. Verification: Analysis of blocked outbound connection attempts in firewall logs.
Controls 1 and 2 are intended to prevent or hinder initial access to the vulnerability, while control 3 is designed to limit damage following a successful exploit.
Remediation priorities
Remediation should be prioritized for systems where the Visual Composer Metadata Uploader is active, given its known use in ransomware campaigns. The supported corrective action is to apply the mitigations provided by the vendor in SAP Note 3604119. Access to this note requires a registered SAP account.
How to validate remediation
Verification must move beyond confirming that a patch was deployed. Defenders should verify the result through:
* Configuration Audit: Confirming the specific component version matches the patched state defined in the vendor note.
* Functional Testing: Ensuring the Metadata Uploader remains operational after the mitigation is applied, as failures here may lead to unauthorized workarounds.
Limits and open questions
Applying the vendor’s mitigation could reduce the likelihood of exploitation but does not guarantee total system security. Residual risk remains if privileged accounts are compromised via other vectors (e.g., phishing or credential theft), as this vulnerability highlights the impact of privileged access within the SAP ecosystem. It is currently unknown if compensating controls exist for environments where patching is not immediately feasible.
Source and editorial note
CVE-2025-42999: SAP NetWeaver Deserialization Vulnerability · Source date: May 15, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: May 18, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 14, 2026 at 00:50 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗