Loading story…
Attackers are actively exploiting critical SAP NetWeaver Visual Composer vulnerability CVE-2025-31324 in the Metadata Uploader component. Insufficient access controls allow unauthenticated remote attackers to upload malicious files to vulnerable servers, with observed intrusions deploying webshells to establish persistent access.
SAP issued an emergency patch, while the Dutch National Cyber Security Centre assessed the threat at High/High and warned that webshells linked to the exploit are being sold online, increasing the risk of widespread abuse. Organizations should immediately apply SAP’s fixes, identify internet-exposed NetWeaver instances, and investigate affected systems for uploaded webshells and other indicators of compromise.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
SAP released an emergency patch for CVE-2025-31324 and security updates for other affected SAP products. The NCSC raised the associated threat level to High/High and advised organizations to promptly patch and inspect exposed systems for webshells.
Attackers exploiting CVE-2025-31324 deployed webshells on compromised systems, enabling later persistent access. Webshells associated with this exploitation were reportedly offered for sale online.
SAP and the Dutch NCSC observed active exploitation of CVE-2025-31324, a critical insufficient-access-control flaw in the Metadata Uploader component of SAP NetWeaver Visual Composer. The flaw allows unauthenticated attackers to upload malicious files to vulnerable servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP patched **CVE-2025-31324**, a critical `CVSS 10.0` flaw in **SAP NetWeaver Visual Composer** that lets unauthenticated attackers send crafted HTTP `POST` requests to `/developmentserver/metadatauploader`, upload arbitrary files, and achieve remote code execution. Security researchers and national CSIRT reporting said the bug was actively exploited against exposed, high-value SAP systems, with attackers planting **JSP webshells** for persistent remote access and using the compromise to fully take over affected servers. SAP addressed the issue in **Security Note `3594142`** and urged customers to patch immediately or temporarily reduce exposure by disabling Visual Composer, disabling the `developmentserver` alias, and restricting access to the vulnerable endpoint. A second NetWeaver Visual Composer flaw, **CVE-2025-42999**, was later fixed in **Security Note `3604119`** after reports that attackers were chaining it with the first bug for stealthier post-compromise activity. That deserialization vulnerability requires high privileges but can also lead to arbitrary file upload and code execution, and researchers said exploitation had been observed since at least January 2025. Reporting linked the campaign to multiple threat actors, including **BianLian** and **RansomEXX**, with intrusions involving tools such as **Brute Ratel** and **Heaven's Gate** techniques to evade detection, prompting defenders to review uploaded files, inspect logs, and hunt for unauthorized webshells and follow-on payloads.
Jul 24, 2026
SAP disclosed **CVE-2025-31324**, a critical `CVSS 10.0` zero-day in NetWeaver Visual Composer caused by a missing authorization check in the Metadata Uploader component. The flaw allows unauthenticated attackers to send crafted `POST` requests to the `/developmentserver/metadatauploader` endpoint and upload malicious files, creating a path to remote code execution on affected SAP NetWeaver `7.xx` systems where Visual Composer is installed. Rapid7 reported that exploitation had been occurring in the wild since at least late March, with multiple customer environments affected and manufacturing organizations appearing heavily targeted. Investigators observed attackers deploying JSP webshells such as `helper.jsp`, `cache.jsp`, and randomly named eight-character files in NetWeaver directories tied to `irj`, indicating post-exploitation persistence and hands-on access. As defenders rushed to respond, public GitHub repositories quickly appeared with proof-of-concept code, Burp and Nuclei detection templates, and later compromise-assessment tooling from Onapsis and Mandiant covering **CVE-2025-31324** and the related **CVE-2025-42999**. SAP urged customers to patch immediately or disable Visual Composer, restrict access to the vulnerable endpoint, and investigate systems for indicators of compromise.
Jun 29, 2026
Authorities warned that the Apache Log4j flaw was being exploited at scale as defenders struggled to identify the vulnerable library across widely used applications and services. The issue affected many popular products, exploitation attempts rose sharply, and domestic organizations were also targeted. Administrators were urged to update affected Log4j deployments immediately, with guidance pointing to version `2.17.0`, while noting that remediation was slowed by the difficulty of locating the component, validating fixes, and rolling out updates. A separate alert said a critical zero-day in **SAP NetWeaver Visual Composer Framework 7.xx** allowed arbitrary code execution on SAP application servers and could lead to full server compromise and lateral movement. The vulnerable component was described as trivial to exploit when exposed to the internet, and officials said attacks in Finland had begun weeks before public disclosure. Organizations were told to apply SAP’s fixes at once, inspect systems for compromise by reviewing server files and HTTP requests to the `metadatauploader` endpoint, and treat any internet-exposed server that was not promptly patched and investigated as potentially compromised.
Jun 29, 2026