Loading vulnerability…
Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader
CVE-2025-42999 is an insecure deserialization vulnerability in the SAP NetWeaver Visual Composer Metadata Uploader, affecting Visual Composer Framework component VCFRAMEWORK 7.50. A privileged attacker can upload specially crafted content containing malicious serialized objects, which the component deserializes insecurely, potentially enabling arbitrary code execution and compromise of the host system. Although exploitation of this vulnerability alone requires high privileges, chaining it with CVE-2025-31324 allows unauthenticated attackers to reach the vulnerable functionality and execute operating system commands. The vulnerability has a CVSS 3.1 score of 9.1 and has been actively exploited.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of the affected SAP host, including sensitive data disclosure, unauthorized data modification, and disruption of business-critical services. The publicly demonstrated chain with CVE-2025-31324 enables complete SAP system takeover through command execution with SAP operating-system administrator privileges. CISA lists the vulnerability in its Known Exploited Vulnerabilities Catalog and identifies known ransomware campaign use.
If you can’t patch tonight, do this now.
Until the correction is installed, disable Visual Composer or its developmentserver alias, or restrict access to the Metadata Uploader endpoint to trusted administrative sources. Restrict Internet access to SAP applications and monitor for unexpected uploads and unusual processes. Onapsis and Mandiant assessment and compromise-detection tools can support investigation of systems exposed to CVE-2025-31324 and CVE-2025-42999. These measures do not replace vendor patching.
Patch, then assume compromise.
Apply SAP Security Note 3604119, released on May 13, 2025, using the applicable corrections and installation instructions for the deployed component. Also ensure that the correction for CVE-2025-31324 in SAP Security Note 3594142 is installed. Applying only the earlier CVE-2025-31324 correction leaves residual risk addressed by Note 3604119. Exact corrected patch levels are not specified in the available information. Because exploitation has occurred, investigate affected systems for existing compromise; patching does not remove previously established attacker access.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
65 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.