1. Home
  2. Mapping Frameworks
  3. Known Exploited Vulnerabilities Home
  4. SAP NetWeaver Deserialization Vulnerability

Known Exploited Vulnerabilities CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CVE-2025-42999 SAP NetWeaver Deserialization Vulnerability exploitation_technique T1190 Exploit Public-Facing Application
Comments
This deserialization vulnerability in NetWeaver Visual Composer, when chained with CVE-2025-31324, allows an attacker to execute unauthenticated remote code with administrator privileges, leading to consequences such as web shell deployment.
References
  1. https://onapsis.com/blog/new-exploit-for-cve-2025-31324/
CVE-2025-42999 SAP NetWeaver Deserialization Vulnerability exploitation_technique T1203 Exploitation for Client Execution
Comments
This deserialization vulnerability in NetWeaver Visual Composer, when chained with CVE-2025-31324, allows an attacker to execute unauthenticated remote code with administrator privileges, leading to consequences such as web shell deployment.
References
  1. https://onapsis.com/blog/new-exploit-for-cve-2025-31324/
CVE-2025-42999 SAP NetWeaver Deserialization Vulnerability primary_impact T1059 Command and Scripting Interpreter
Comments
This deserialization vulnerability in NetWeaver Visual Composer, when chained with CVE-2025-31324, allows an attacker to execute unauthenticated remote code with administrator privileges, leading to consequences such as web shell deployment.
References
  1. https://onapsis.com/blog/new-exploit-for-cve-2025-31324/
CVE-2025-42999 SAP NetWeaver Deserialization Vulnerability secondary_impact T1505.003 Web Shell
Comments
This deserialization vulnerability in NetWeaver Visual Composer, when chained with CVE-2025-31324, allows an attacker to execute unauthenticated remote code with administrator privileges, leading to consequences such as web shell deployment.
References
  1. https://onapsis.com/blog/new-exploit-for-cve-2025-31324/