CVE-2025-42999CRITICAL 9.1CISA KEVEPSS p95.3%

CVE-2025-42999SAP NetWeaver Deserialization Vulnerability

SAP / NetWeaver

Description

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.

Scoring

CVSS 3.19.1 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS10.85% probability of exploitation · percentile 95.3% · 2026-06-18T12:00:27Z
Published2025-05-13
Last modified2025-10-31

CISA KEV entry

Added to KEV: 2025-05-15

Underlying weaknesses· 1

CWE-502

References

  1. https://me.sap.com/notes/3604119
  2. https://url.sap/sapsecuritypatchday
  3. https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
  4. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42999

1

TypeTargetConfidenceTier
WeaknessDeserialization of Untrusted Datacwe-5020%live

(incoming)1

TypeTargetConfidenceTier
KEVEntrySAP NetWeaver Deserialization Vulnerabilitykev-cve-2025-429990%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-42964
CVE
SAP NetWeaver Unrestricted File Upload Vulnerability
CVE
CVE-2025-42980
CVE
CVE-2025-42966
CVE
CVE-2026-27685
CVE
CVE-2025-42963
Sourced from NVD + CISA KEV + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.