PT-2025-20812 · Sap · Sap Netweaver Visual Composer

Published 2025-05-13 · Updated 2025-10-29 · CVE-2025-42999

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Visual Composer (affected versions not specified)

Description The issue arises when a privileged user uploads untrusted or malicious content, which upon deserialization, could compromise the confidentiality, integrity, and availability of the host system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-05676

CVE-2025-42999

Affected Products

Sap Netweaver Visual Composer

References · 77

• 🔥 https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324 · Exploit
• https://osv.dev/vulnerability/CVE-2025-42999 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05676 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42999 · Security Note
• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://reddit.com/r/SecOpsDaily/comments/1mujas8/public_exploit_for_chained_sap_flaws_exposes · Reddit Post
• https://twitter.com/socradar/status/1922917364447969768 · Twitter Post
• https://twitter.com/TheHackersNews/status/1922568884437106928 · Twitter Post
• https://t.me/cvenotify/122461 · Telegram Post
• https://t.me/latest_high_impact_cve/2345 · Telegram Post
• https://t.me/cvetracker/23681 · Telegram Post
• https://twitter.com/RedLegg/status/1922739710029381817 · Twitter Post
• https://twitter.com/CVEnew/status/1922135010624012356 · Twitter Post
• https://t.me/thehackernews/6829 · Telegram Post
• https://twitter.com/onapsis/status/1957516426635333910 · Twitter Post