SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

A new exploit chain targeting CVE-2025-31324 and CVE-2025-42999 has been observed. Patches are available and should be applied quickly

SAP released a new security note for this flaw, which researchers say has been exploited as part of chained attacks using CVE-2025-31324.

SAP NetWeaver Visual Composer is affected by an insecure deserialization vulnerability caused by insufficient validation of uploaded content, when deserialized, provided by a high-privileged user. This allows an attacker to potentially compromise the confidentiality, integrity, and availability of the host system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

SAP NetWeaver Visual Composer is affected by multiple vulnerabilities, including the following:

  - SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user     can upload untrusted or malicious content which, when deserialized, could potentially     lead to a compromise of confidentiality, integrity, and availability of the host system.
    (CVE-2025-42999)

  - SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an     authenticated attacker with SAP standard authorization to execute a certain function module     remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due     to lack of input validation and no authorization checks. This has low Confidentiality impact     but high impact on integrity and availability to the application.
    (CVE-2025-43010)

  - Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform     the necessary authorization checks, allowing authenticated users to access restricted     functionalities or data. This can lead to a high impact on confidentiality with no impact     on the integrity or availability of the application.
    (CVE-2025-43011)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
242564	SAP Netweaver Visual Composer Insecure Deserialization (3604119)	Nessus	Web Servers	Remote	critical
236840	SAP Netweaver Visual Composer Multiple Vulnerabilities (May 2025)	Nessus	Web Servers	Remote	critical

Detections

Analytics

CVE-2025-42999

critical

Tenable Plugins

critical

critical