PT-2025-20812 · Sap · Sap Netweaver Visual Composer

Published 2025-05-13 · Updated 2025-10-29 · CVE-2025-42999

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Visual Composer (affected versions not specified)

Description The issue arises when a privileged user uploads untrusted or malicious content, which upon deserialization, could compromise the confidentiality, integrity, and availability of the host system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-05676

CVE-2025-42999

Affected Products

Sap Netweaver Visual Composer

References · 79

• 🔥 https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-42999 · Security Note
• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05676 · Security Note
• https://twitter.com/helpnetsecurity/status/1958115833600778553 · Twitter Post
• https://twitter.com/RedLegg/status/1922739710029381817 · Twitter Post
• https://twitter.com/dCypherIO/status/1922743720040140918 · Twitter Post
• https://twitter.com/shah_sheikh/status/1958114890914070930 · Twitter Post
• https://t.me/cvenotify/122669 · Telegram Post
• https://t.me/cvetracker/23681 · Telegram Post
• https://twitter.com/djhsecurity/status/1925197057406423198 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-42999 · Note
• https://twitter.com/ScyScan/status/1924540888564563972 · Twitter Post
• https://twitter.com/cracbot/status/1924057466037539191 · Twitter Post
• https://twitter.com/huseyin_yu46083/status/1961796705143173614 · Twitter Post