Security readout for executives and security teams
Plain-English summary
A privileged SAP user can upload malicious content to the Visual Composer Metadata Uploader. When SAP processes that content, it may compromise the host system’s data, integrity, and availability. The issue is critical despite requiring elevated privileges because successful exploitation can have system-wide consequences.
Executive priority
Treat this as an immediate remediation and investigation priority for affected systems. CISA KEV inclusion indicates real-world exploitation, while successful abuse could compromise the host. Quickly establish whether VCFRAMEWORK 7.50 is deployed, apply SAP’s prescribed remediation, restrict uploader access, and investigate suspicious activity.
Technical view
CVE-2025-42999 is a CWE-502 insecure deserialization flaw affecting SAP NetWeaver Visual Composer development server, VCFRAMEWORK 7.50. It is remotely reachable, low complexity, requires high privileges, and needs no user interaction. Its CVSS 3.1 score is 9.1, with potential high-impact compromise across confidentiality, integrity, and availability.
Likely exposure
Exposure is limited to environments running VCFRAMEWORK 7.50 where privileged users can access the Metadata Uploader. The bundle identifies other versions as unaffected by default. Internet accessibility, uploader configuration, and customer deployment prevalence are not established by the supplied evidence.
Exploitation context
CISA’s Known Exploited Vulnerabilities status supports that CVE-2025-42999 has been exploited in the wild. The supplied bundle does not describe attack frequency, victims, indicators, or exploitation methods. The Onapsis reference concerns CVE-2025-31324, so it should not be treated as direct evidence for this vulnerability.
Researcher notes
The attack prerequisite is a privileged user able to upload untrusted content; the bundle does not clarify required roles, exposed endpoints, serialized formats, patch identifiers, or indicators. Do not conflate this issue with CVE-2025-31324. Use SAP Note 3604119 as the authoritative source for remediation and technical applicability.
Mitigation direction
- Review SAP Security Note 3604119 and apply its vendor-prescribed remediation promptly.
- Use SAP Security Patch Day guidance to confirm applicable updates and prerequisites.
- Restrict Metadata Uploader access to necessary, trusted privileged accounts until remediation is verified.
- Review and reduce privileged SAP accounts capable of uploading Visual Composer metadata.
Validation and detection
- Inventory SAP systems and identify installations running VCFRAMEWORK 7.50.
- Verify SAP Security Note 3604119 remediation status using approved SAP maintenance records.
- Confirm only authorized privileged accounts can access the Metadata Uploader.
- Review available SAP and host logs for unusual uploads or subsequent privileged activity.
- Follow SAP guidance for compromise assessment if suspicious activity is identified.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-42999 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H2.36sapVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-42999 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-05-15T00:00:00.000Z: CVE-2025-42999 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://me.sap.com/notes/3604119CVE reference, sap
- https://url.sap/sapsecuritypatchdayCVE reference, sap
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42999CVE reference, CISA-ADP · government-resource
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.