Linked CVE review

Assess and apply SAP security advisory 3604119

Linked CVEs: 1
Confirmed exploited: 1
PoC or lab evidence: 1
Maximum CVSS: 9.1

Evidence is kept separate

Confirmed exploitation, public exploit material, EPSS probability and CVSS severity answer different questions. “No confirmation recorded” means the checked sources do not currently confirm exploitation. It is not proof that exploitation has not occurred.

1 of 1 linked CVEs shown

Confirmed exploitedCVSS above 9.0

CVE and description	Severity	Exploit reality	Forecast and access	Remediation
CVE-2025-42999 Immediate evidence SAP NetWeaver Deserialization Vulnerability SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.	9.1 · CVSS 3.1 · CriticalSource: CNA	Confirmed in the wildCISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2025-05-15. Known ransomware campaign use is recorded.Public exploit referencedA structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.	EPSS: 13.9% · 96.4th percentileForecast date: 2026-10-07NETWORK · LOW complexity · HIGH privileges · NONE user interaction	Patch nowCISA confirms exploitation in the wild and lists 2025-06-05 as the remediation due date.Mitigation available. No fixed version is explicitly recorded in the structured CVE data.