Advisory
A note with CVSS 9.1 for component EP-VC-INF was released by SAP on 13.05.2025. The correction/advisory 3604119 was described with "[CVE-2025-42999] Insecure Deserialization in SAP NetWeaver (Visual Composer development server)" and affects the system type Java.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process.
The vulnerability addressed is remote code execution vulnerability within Java.
Risk specification
This note has been re-released with an updated description. SAP NetWeaver (Visual Composer development server) allows a privileged user to upload untrusted or malicious content, resulting in remote code execution through insecure deserialization.Solution
The application removed the deserialization functionality, resolving the vulnerability. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "A temporary workaround is described in KBA 3593336. Applicability should be assessed before use; applying the full correction is strongly recommended.".
Affected System
SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform. It provides the complete infrastructure for deploying and running Java applications.
- The AS Java Home: SAP Netweaver Application Server Java wiki
- A dedicated SAP NetWeaver 7.40 Application Server for Java Security Guide exists.
The advisory is valid for
