Advisory
A note with CVSS 9.1 for component EP-VC-INF was released by SAP on 13.05.2025. The correction/advisory 3604119 was described with "[CVE-2025-42999] Insecure Deserialization in SAP NetWeaver (Visual Composer development server)" and affects the system type Java.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process.
The vulnerability addressed is remote code execution vulnerability within Java.
Risk specification
SAP NetWeaver (Visual Composer development server) is affected by a vulnerability that allows a privileged user to upload untrusted or malicious content. This can lead to remote code execution through insecure deserialization, posing a significant risk to system integrity and security.Solution
The vulnerability has been resolved by removing the deserialization functionality from the application, effectively eliminating the risk of remote code execution. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "A temporary workaround is described in KBA 3593336. Applicability should be assessed before use; applying the full correction is strongly recommended.".
Affected System
SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform. It provides the complete infrastructure for deploying and running Java applications.
- The AS Java Home: SAP Netweaver Application Server Java wiki
- A dedicated SAP NetWeaver 7.40 Application Server for Java Security Guide exists.
The advisory is valid for
