Loading story…
Authorities warned that the Apache Log4j flaw was being exploited at scale as defenders struggled to identify the vulnerable library across widely used applications and services. The issue affected many popular products, exploitation attempts rose sharply, and domestic organizations were also targeted. Administrators were urged to update affected Log4j deployments immediately, with guidance pointing to version 2.17.0, while noting that remediation was slowed by the difficulty of locating the component, validating fixes, and rolling out updates.
A separate alert said a critical zero-day in SAP NetWeaver Visual Composer Framework 7.xx allowed arbitrary code execution on SAP application servers and could lead to full server compromise and lateral movement. The vulnerable component was described as trivial to exploit when exposed to the internet, and officials said attacks in Finland had begun weeks before public disclosure. Organizations were told to apply SAP’s fixes at once, inspect systems for compromise by reviewing server files and HTTP requests to the metadatauploader endpoint, and treat any internet-exposed server that was not promptly patched and investigated as potentially compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On 2025-04-30, Traficom published an alert about a critical actively exploited zero-day in SAP NetWeaver Visual Composer Framework 7.xx. It urged organizations to patch immediately, investigate exposed systems for compromise, and presume unpatched internet-exposed servers may be compromised.
Finland’s National Cyber Security Centre said it is aware of exploitation of the SAP NetWeaver Visual Composer vulnerability in Finland, with the first attacks occurring in mid-March 2025. The flaw can enable arbitrary code execution and full server compromise when the vulnerable component is exposed to the network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP patched **CVE-2025-31324**, a critical `CVSS 10.0` flaw in **SAP NetWeaver Visual Composer** that lets unauthenticated attackers send crafted HTTP `POST` requests to `/developmentserver/metadatauploader`, upload arbitrary files, and achieve remote code execution. Security researchers and national CSIRT reporting said the bug was actively exploited against exposed, high-value SAP systems, with attackers planting **JSP webshells** for persistent remote access and using the compromise to fully take over affected servers. SAP addressed the issue in **Security Note `3594142`** and urged customers to patch immediately or temporarily reduce exposure by disabling Visual Composer, disabling the `developmentserver` alias, and restricting access to the vulnerable endpoint. A second NetWeaver Visual Composer flaw, **CVE-2025-42999**, was later fixed in **Security Note `3604119`** after reports that attackers were chaining it with the first bug for stealthier post-compromise activity. That deserialization vulnerability requires high privileges but can also lead to arbitrary file upload and code execution, and researchers said exploitation had been observed since at least January 2025. Reporting linked the campaign to multiple threat actors, including **BianLian** and **RansomEXX**, with intrusions involving tools such as **Brute Ratel** and **Heaven's Gate** techniques to evade detection, prompting defenders to review uploaded files, inspect logs, and hunt for unauthorized webshells and follow-on payloads.
Jul 24, 2026
SAP has released security updates addressing 13 newly identified vulnerabilities across its product suite, with particular focus on a maximum-severity flaw in SAP NetWeaver AS Java. The most critical vulnerability, tracked as CVE-2025-42944 and assigned a CVSS score of 10.0, is an insecure deserialization issue that allows unauthenticated attackers to execute arbitrary operating system commands. This flaw can be exploited via the RMI-P4 module by submitting a malicious payload to an open port, potentially compromising the confidentiality, integrity, and availability of affected systems. SAP initially addressed this vulnerability in a previous update, but the latest patch introduces additional hardening measures, including a JVM-wide filter (jdk.serialFilter) to block the deserialization of dangerous classes. The list of classes and packages to be filtered was developed in collaboration with the Onapsis Research Labs and is divided into mandatory and optional sections to maximize protection. In addition to CVE-2025-42944, SAP has patched a directory traversal vulnerability in SAP Print Service (CVE-2025-42937, CVSS 9.8), which could allow unauthenticated attackers to overwrite system files by exploiting insufficient path validation. Another critical issue, CVE-2025-42910 (CVSS 9.0), affects SAP Supplier Relationship Management and involves unrestricted file upload, enabling authenticated attackers to upload arbitrary files, including potentially malicious executables. These vulnerabilities collectively pose significant risks to enterprise environments running SAP solutions, as successful exploitation could lead to system compromise, data loss, or service disruption. SAP has stated that there is currently no evidence of these vulnerabilities being exploited in the wild. Security experts and SAP have emphasized the importance of promptly applying the latest patches to mitigate the risk of exploitation. The additional hardening for the deserialization flaw is particularly notable, as it provides a more robust defense against a class of attacks that have historically been difficult to fully remediate. Organizations are advised to review their SAP deployments, ensure all relevant updates are applied, and follow SAP’s guidance on blocking risky deserialization classes. The disclosure and remediation of these vulnerabilities highlight the ongoing challenges in securing complex enterprise software platforms. SAP’s collaboration with security researchers and the implementation of layered defenses demonstrate a proactive approach to addressing critical security issues. Enterprises relying on SAP NetWeaver and related products should prioritize these updates as part of their regular patch management processes. Failure to address these vulnerabilities could leave systems exposed to remote attacks that require no authentication, significantly increasing the risk profile for affected organizations. The security community continues to monitor for any signs of exploitation and urges vigilance in maintaining up-to-date SAP environments.
Jun 29, 2026
SAP released multiple security updates addressing critical vulnerabilities across core enterprise products, including **SAP NetWeaver**, **SAP S/4HANA**, **SAP Commerce Cloud**, **SAP Business Warehouse**, **SAP Business Planning and Consolidation**, **SAP Kernel**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, and **SAP Forecasting & Replenishment**. The fixes covered at least 15 vulnerabilities in both the April-to-June advisories, with several flaws rated **critical** and carrying CVSS scores from **9.0 to 9.9**. Reported impacts included **SQL injection**, **remote code execution**, **operating system command execution**, **directory traversal**, **memory corruption**, **sensitive data exposure**, **denial of service**, privilege abuse, and potential full compromise of confidentiality, integrity, and availability. Among the most severe issues, **CVE-2026-27681** affected SAP Business Planning and Consolidation and SAP Business Warehouse, allowing a low-privileged authenticated attacker to upload a file containing SQL commands and execute arbitrary database operations; SAP said a temporary mitigation was to revoke the `S_GUI` authorization object with Activity 60 (Upload) where possible. Additional high-risk flaws included **CVE-2026-34260** and **CVE-2026-34263** in SAP S/4HANA, SAP Commerce Cloud, and SAP Forecasting & Replenishment, each scored **9.6**, as well as critical June issues in NetWeaver-related components that could enable unauthorized access, file-processing abuse, and system compromise. SAP and national defenders urged organizations to apply vendor-specified patches immediately.
Jul 24, 2026