Loading story…
SAP disclosed CVE-2025-31324, a critical CVSS 10.0 zero-day in NetWeaver Visual Composer caused by a missing authorization check in the Metadata Uploader component. The flaw allows unauthenticated attackers to send crafted POST requests to the /developmentserver/metadatauploader endpoint and upload malicious files, creating a path to remote code execution on affected SAP NetWeaver 7.xx systems where Visual Composer is installed. Rapid7 reported that exploitation had been occurring in the wild since at least late March, with multiple customer environments affected and manufacturing organizations appearing heavily targeted.
Investigators observed attackers deploying JSP webshells such as helper.jsp, cache.jsp, and randomly named eight-character files in NetWeaver directories tied to irj, indicating post-exploitation persistence and hands-on access. As defenders rushed to respond, public GitHub repositories quickly appeared with proof-of-concept code, Burp and Nuclei detection templates, and later compromise-assessment tooling from Onapsis and Mandiant covering CVE-2025-31324 and the related CVE-2025-42999. SAP urged customers to patch immediately or disable Visual Composer, restrict access to the vulnerable endpoint, and investigate systems for indicators of compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A GitHub-hosted assessment tool for CVE-2025-31324 and CVE-2025-42999 was published by Onapsis and Mandiant to help organizations evaluate vulnerability exposure and signs of compromise.
Rapid7 published research on 2025-04-28 confirming in-the-wild exploitation across multiple customer environments and describing attacker use of JSP webshells such as helper.jsp and cache.jsp. The company also released detection and exposure assessment coverage, while noting it had not attributed the activity to a specific threat actor.
A proof-of-concept repository for CVE-2025-31324 was published on GitHub, demonstrating public technical exploitation details for the unauthenticated upload issue in SAP NetWeaver Visual Composer.
Public defensive tooling to identify exposure to CVE-2025-31324 began appearing on GitHub, including a Burp Suite extension and later a Nuclei template for checking vulnerable SAP NetWeaver instances.
On 2025-04-24, SAP disclosed CVE-2025-31324, a critical 10.0-severity missing authorization flaw in the NetWeaver Visual Composer Metadata Uploader that allows unauthenticated file upload. SAP advised customers to patch immediately or disable Visual Composer, restrict access to the vulnerable endpoint, and investigate for compromise.
Rapid7 observed active exploitation of CVE-2025-31324 dating back to at least 2025-03-27. The attacks targeted SAP NetWeaver Visual Composer systems and involved uploading JSP webshells, with manufacturing organizations notably affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcerapid7.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP patched **CVE-2025-31324**, a critical `CVSS 10.0` flaw in **SAP NetWeaver Visual Composer** that lets unauthenticated attackers send crafted HTTP `POST` requests to `/developmentserver/metadatauploader`, upload arbitrary files, and achieve remote code execution. Security researchers and national CSIRT reporting said the bug was actively exploited against exposed, high-value SAP systems, with attackers planting **JSP webshells** for persistent remote access and using the compromise to fully take over affected servers. SAP addressed the issue in **Security Note `3594142`** and urged customers to patch immediately or temporarily reduce exposure by disabling Visual Composer, disabling the `developmentserver` alias, and restricting access to the vulnerable endpoint. A second NetWeaver Visual Composer flaw, **CVE-2025-42999**, was later fixed in **Security Note `3604119`** after reports that attackers were chaining it with the first bug for stealthier post-compromise activity. That deserialization vulnerability requires high privileges but can also lead to arbitrary file upload and code execution, and researchers said exploitation had been observed since at least January 2025. Reporting linked the campaign to multiple threat actors, including **BianLian** and **RansomEXX**, with intrusions involving tools such as **Brute Ratel** and **Heaven's Gate** techniques to evade detection, prompting defenders to review uploaded files, inspect logs, and hunt for unauthorized webshells and follow-on payloads.
Jul 24, 2026
Authorities warned that the Apache Log4j flaw was being exploited at scale as defenders struggled to identify the vulnerable library across widely used applications and services. The issue affected many popular products, exploitation attempts rose sharply, and domestic organizations were also targeted. Administrators were urged to update affected Log4j deployments immediately, with guidance pointing to version `2.17.0`, while noting that remediation was slowed by the difficulty of locating the component, validating fixes, and rolling out updates. A separate alert said a critical zero-day in **SAP NetWeaver Visual Composer Framework 7.xx** allowed arbitrary code execution on SAP application servers and could lead to full server compromise and lateral movement. The vulnerable component was described as trivial to exploit when exposed to the internet, and officials said attacks in Finland had begun weeks before public disclosure. Organizations were told to apply SAP’s fixes at once, inspect systems for compromise by reviewing server files and HTTP requests to the `metadatauploader` endpoint, and treat any internet-exposed server that was not promptly patched and investigated as potentially compromised.
Jun 29, 2026
SAP disclosed **CVE-2026-44747**, a critical memory corruption vulnerability in **SAP NetWeaver Application Server ABAP**, and published remediation guidance in **Security Note `3747367`** as part of its Security Patch Day materials. The flaw is classified as **CWE-787** and affects multiple SAP ABAP kernel releases, including `KRNL64NUC 7.22`, `7.22EXT`, `KRNL64UC 7.22`, `7.53`, `7.54`, `7.77`, `7.89`, `7.93`, and `9.16` through `9.20`. The vulnerability can be exploited remotely by an authenticated attacker with low privileges and carries a **CVSS v3.1 score of 9.1** (`AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`). Successful exploitation could cause unauthorized data access, data modification, privilege escalation, or system unavailability. Public reporting said there was **no confirmed active exploitation** at the time of disclosure, but the impact profile makes patching affected SAP environments a priority.
Jul 23, 2026