---
id: "CVE-2025-42999"
kind: "vulnerability"
aliases: ["CVE-2025-42999"]
title: "SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or\u2026"
severity: "critical"
cvss: 9.1
epss: null
exploited: true
status: "open"
category: "runtime"
products: [{"name": "SAP NetWeaver", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "sap netweaver", "fixed": [], "affected": "= 7.5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "netweaver", "ransomware", "runtime", "sap"]
not_affected_if: ["no-visual-composer", "patched"]
published_at: "2025-05-13T01:15:48+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-42999", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42999", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or…

SAP NetWeaver's Visual Composer Metadata Uploader deserializes untrusted content without safe checks. A privileged attacker can use this to compromise confidentiality, integrity and availability of the host running it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver affected ? fixed ?
- vendor:sap netweaver affected = 7.5 fixed ?

## How to check

Check whether the SAP NetWeaver system runs the Visual Composer Metadata Uploader component and confirm the patch level against the SAP Security Note linked in the CISA entry. unknown

## Fix

Apply the SAP vendor mitigation or patch per SAP instructions; if no mitigation exists, discontinue use of the product as CISA directs. unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-42999
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-42999

## From the sources

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_