CVE-2025-31324

Successful exploitation can compromise the confidentiality, integrity, and availability of the affected SAP system through attacker-controlled code execution. Uploaded webshells can enable unauthorized access, command execution, malicious payload deployment, data access or modification, and service disruption. Observed post-exploitation activity includes reverse shells and reverse SSH SOCKS proxies, which can support persistent access and access to additional reachable resources.

Until the correction is installed, restrict access to /developmentserver/metadatauploader using firewall rules, reverse-proxy controls, or access-control lists. Disable Visual Composer entirely where it is unused. Reduce unnecessary Internet exposure and segment affected SAP systems from critical infrastructure. Forward relevant logs to a SIEM and inspect servlet deployment locations for unauthorized executable files and suspicious upload or execution activity. These measures do not replace the SAP correction.

Apply the SAP security correction referenced in SAP Security Note 3594142 for affected Visual Composer Framework 7.50 installations. Prioritize reachable systems because exploitation is confirmed. Inspect affected systems for unauthorized uploaded files, webshells, and subsequent malicious activity; the Onapsis and Mandiant compromise-assessment tool can support this investigation. Patching prevents exploitation of the corrected flaw but does not remove previously deployed backdoors, which require separate incident-response remediation.