Back to CVE Browser

CVE-2025-31324

🔥 Known Exploited (CISA KEV)CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-04-24

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

Affected Platforms (CPE)

📦

Sap

Netweaver

= 7.50

References & Advisories

🔗 https://me.sap.com/notes/3594142

🔗 https://url.sap/sapsecuritypatchday

🔗 https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/

🔗 https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/

🔗 https://www.theregister.com/2025/04/25/sap_netweaver_patch/

🔗 https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324

Related Security Intelligence Articles

Global Cyber Intel Digest: July 20, 2026

Technical analysis of zero-day exploit chains against SonicWall SMA1000 appliances (UTA0533), NGINX regular expression heap corruption vulnerabilities (CVE-2026-42533), and Sandworm's (UAC-0145) ClickFix fake CAPTCHA campaigns.

Related Vulnerabilities

CVE-2026-447604.7

Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Applicat...

CVE-2026-447596.1

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts a...

CVE-2026-447528.2

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When...

CVE-2026-447479.9

SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a ...