Critical SAP Vulns Under Exploitation in 'One-Two Punch' Attack

Two critical SAP NetWeaver Visual Composer vulnerabilities (CVE-2025-31324 and CVE-2025-42999) have been chained into a deserialization exploit that can yield remote code execution and full system takeover; the exploit was published on threat-actor channels and VX-Underground and is reported to be actively exploited. Organizations should apply SAP Security Note 3594142 and Security Note 3604119 to mitigate the risk.