CVEブラウザに戻る

CVE-2025-31324

🔥 Known Exploited (CISA KEV)CRITICAL

10.0

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-04-24

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

Affected Platforms (CPE)

📦

Sap

Netweaver

= 7.50

References & Advisories

🔗 https://me.sap.com/notes/3594142

🔗 https://url.sap/sapsecuritypatchday

🔗 https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/

🔗 https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/

🔗 https://www.theregister.com/2025/04/25/sap_netweaver_patch/

🔗 https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324

関連するセキュリティ記事

グローバルサイバー脅威インテリジェンス概要：2026年7月20日

本期の安全脅威インテリジェンス概要：SonicWall SMA1000のゼロデイ脆弱性チェーンの悪用、NGINX正規表現Map処理におけるヒープバッファオーバーフロー（CVE-2026-42533）、SandwormサブクラスUAC-0145によるClickFixソーシャルエンジニアリング攻撃キャンペーン、およびHelloNetによるViPNetコンポーネントを悪用したDLLサイドローディング。

関連する脆弱性情報

CVE-2026-447604.7

Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Applicat...

CVE-2026-447596.1

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts a...

CVE-2026-447528.2

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When...

CVE-2026-447479.9

SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a ...