CVE-2025-42999: SAP NetWeaver Visual Composer Deserialization Vulnerability – Privileged Remote Code Execution Risk
What It Is – A deserialization flaw in the SAP NetWeaver Visual Composer Metadata Uploader allows a privileged attacker to feed crafted objects that are deserialized without proper validation, leading to arbitrary code execution on the host system.
Exploitability – The vulnerability is publicly disclosed (CVE‑2025‑42999) and has a CVSS v3.1 base score of 8.8 (High). No public exploits have been observed yet, but the attack path is straightforward for anyone with sufficient privileges on the NetWeaver instance.
Affected Products – SAP NetWeaver (all supported versions that include the Visual Composer component).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous application‑level control mapping: evidence that input‑validation controls are in place and regularly verified.
- Highlights gaps in secure configuration management that auditors will probe when assessing compliance with frameworks such as NIST CSF 2.0.
- Provides a concrete trigger for defensible audit trails – logging of deserialization events and remediation actions can be captured as proof of due diligence.
Recommended Actions
- Apply SAP’s security patch for CVE‑2025‑42999 immediately.
- Review and harden deserialization handling in custom Visual Composer extensions; enforce strict schema validation.
- Enable detailed logging of metadata upload activity and integrate logs into your SIEM for continuous monitoring.
- Update your control‑mapping repository to reflect the new mitigation and capture evidence for audit readiness.
Source: CISA KEV – CVE‑2025‑42999