CVE-2025-42999

What it actually does

This is an insecure deserialization vulnerability in SAP NetWeaver Visual Composer Metadata Uploader. A user with sufficient privileges to upload Visual Composer metadata can submit crafted content that is deserialized by the server, potentially allowing attacker-controlled object execution in the SAP Java runtime context. Successful exploitation can compromise confidentiality, integrity, and availability by enabling arbitrary code execution, unauthorized data access, application modification, persistence, or service disruption on the affected host.

Why it matters to the business

Because SAP NetWeaver commonly supports business-critical ERP, portal, integration, and workflow functions, exploitation can lead to outage of core business processes, theft or manipulation of sensitive enterprise data, and lateral movement into connected SAP and non-SAP systems. This issue is in the CISA Known Exploited Vulnerabilities catalog, is reported as used in ransomware activity, has active in-the-wild exploitation, and the CISA remediation due date of 2025-06-05 has passed, so unpatched or exposed systems should be treated as high-priority operational risk.

How an attack unfolds

An attacker first obtains or abuses a privileged SAP NetWeaver account that can access the Visual Composer Metadata Uploader. The attacker then uploads crafted metadata containing a malicious serialized object payload. When the server processes the upload, the vulnerable deserialization path reconstructs attacker-controlled objects and may trigger code execution in the SAP NetWeaver Java process. From there, the attacker can run commands with the privileges of the SAP application server process, deploy web-accessible backdoors, modify application content, read configuration and credential material, pivot to connected systems, or disrupt service. In ransomware intrusions, this type of access is typically used to establish persistence, stage tools, steal data, and then encrypt or destroy systems after broader network access is achieved.

How to fix it

Apply the relevant SAP security fixes for SAP NetWeaver Visual Composer and ensure the system is updated to a vendor-supported fixed patch level. If no exact fixed version is available in the asset inventory, consult the applicable SAP Security Notes and patch matrix for CVE-2025-42999 and the installed NetWeaver/Visual Composer component versions. Disable Visual Composer and the Metadata Uploader if not required. Restrict uploader access to a minimal set of trusted administrative users, require MFA where supported through the identity provider, and block direct internet access to SAP administrative interfaces. Enforce least privilege for SAP roles, rotate credentials for accounts with uploader or administrative access, and review custom roles that grant Visual Composer administration. Until patching is complete, use network controls or a reverse proxy/WAF to limit access to known administrative networks and monitor or block suspicious uploads to the metadata uploader endpoint. After remediation, hunt for persistence because exploited systems may remain compromised even after patching.

How to confirm the fix worked

Confirm that all SAP NetWeaver Visual Composer components are at the vendor-fixed patch level identified by SAP Security Notes for this vulnerability. Verify that Visual Composer or Metadata Uploader functionality is disabled if not needed. Confirm that the Metadata Uploader is not reachable from the internet and is accessible only from approved administrative networks. Review SAP role assignments to ensure only required privileged users can upload metadata. Perform an authenticated functional test to verify legitimate metadata upload still works after patching, if the feature remains enabled. Search recent HTTP access logs for historical POST requests to the metadata uploader endpoint and confirm they correspond to authorized administrative activity. Inspect SAP Java application directories for unexpected JSP, WAR, EAR, class, JAR, or recently modified artifacts. Review SAP defaultTrace, security audit logs, and operating system process telemetry for deserialization errors, abnormal child processes, or command execution from the SAP Java runtime.

Typical attack path

1. Identify an internet-facing or internally reachable SAP NetWeaver Visual Composer deployment.
2. Obtain privileged SAP credentials through phishing, credential theft, reuse, prior compromise, or insider abuse.
3. Authenticate to the Visual Composer Metadata Uploader functionality.
4. Upload malicious Visual Composer metadata containing a crafted serialized object payload.
5. Trigger server-side deserialization during upload or processing of the metadata.
6. Execute code in the SAP NetWeaver Java runtime context if the payload succeeds.
7. Deploy persistence such as web shells, modified application artifacts, scheduled jobs, or additional administrative users.
8. Collect SAP configuration, credentials, business data, and connection details for downstream systems.
9. Move laterally to other SAP, database, identity, or file-sharing systems.
10. Perform impact actions such as data theft, application tampering, service disruption, or ransomware deployment.

How to detect it

Review HTTP access logs from SAP NetWeaver, reverse proxies, load balancers, and WAFs for authenticated POST requests to the Visual Composer Metadata Uploader, especially from unusual source IPs, outside normal administrative windows, or followed by errors or file writes. Inspect SAP security audit logs and identity-provider logs for unusual privileged logins, role changes, failed MFA events, impossible travel, new administrative users, or service-account use against Visual Composer functions. Search SAP Java defaultTrace, application logs, and system logs for deserialization-related exceptions, class loading errors, invocation errors, or stack traces around metadata upload events. Examine SAP Java application deployment directories and web roots for unexpected JSP, WAR, EAR, JAR, CLASS, ZIP, or serialized files created or modified near suspicious upload times. Use EDR or operating-system telemetry to identify child processes spawned by SAP Java services, including shells, scripting engines, archive tools, download utilities, credential dumping tools, or ransomware staging utilities. Review outbound network connections from SAP application servers for unusual destinations, command-and-control patterns, large data transfers, or connections to file-sharing infrastructure. Because this vulnerability is used in ransomware campaigns, also look for backup deletion, mass file access, encryption tooling, new scheduled tasks or cron jobs, and abnormal access to domain, database, and file-sharing systems after the suspected SAP event.

• POST /developmentserver/metadatauploader
• /developmentserver/metadatauploader
• GET /developmentserver/metadatauploader
• metadatauploader
• Metadata Uploader
• Visual Composer Metadata Uploader
• rO0AB
• aced0005
• java.io.InvalidClassException
• java.io.StreamCorruptedException
• java.lang.ClassNotFoundException
• java.lang.reflect.InvocationTargetException
• java.io.ObjectInputStream
• readObject
• javax.management.BadAttributeValueExpException
• com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl
• .jsp
• cmd.exe /c
• /bin/sh -c
• powershell.exe
• curl
• wget

What your security team should do

• Treat affected SAP NetWeaver Visual Composer systems as urgent because the vulnerability is KEV-listed, actively exploited, associated with ransomware activity, and past the CISA remediation deadline.
• Immediately inventory SAP NetWeaver systems and determine where Visual Composer and Metadata Uploader are installed or reachable.
• Patch to the SAP-fixed level or disable Visual Composer/Metadata Uploader where not business-critical.
• Restrict access to SAP administrative and upload interfaces using network allowlists, VPN or privileged access gateways, and strong authentication.
• Audit all privileged SAP accounts and roles that can use Visual Composer Metadata Uploader; remove unnecessary privileges and rotate credentials for high-risk accounts.
• Hunt for prior exploitation before and after patching, especially suspicious metadata uploads, unexpected JSP files, new administrative users, and child processes spawned by SAP Java services.
• Preserve logs and forensic evidence from SAP application servers, reverse proxies, WAFs, identity providers, and endpoint telemetry for incident response review.
• If suspicious activity is found, isolate affected SAP servers, collect forensic images or triage data, rotate SAP and connected-system credentials, and assess lateral movement and ransomware staging.
• Add SIEM detections for POST requests to the metadata uploader endpoint, Java serialized object markers in uploads, deserialization exceptions, and SAP Java process spawning operating-system shells.
• Ensure SAP NetWeaver hosts are included in EDR, vulnerability scanning, backup validation, and ransomware recovery exercises.