CVE-2025-31324
KEVRansomware UseSAP NetWeaver Unrestricted File Upload Vulnerability
Description
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HPublishedApr 24, 2025
Last modifiedAug 4, 2026
Added to KEVApr 29, 2025
Remediation dueMay 20, 2025
References
- me.sap.com/notes/3594142Permissions Required
- url.sap/sapsecuritypatchdayVendor Advisory
- onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/Third Party Advisory
- bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/Press/Media Coverage
- theregister.com/2025/04/25/sap_netweaver_patch/Press/Media Coverage
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324US Government Resource
0 recent articles mention this CVE
100
Risk assessment · Critical
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 524 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 10.0 CRITICAL
- EPSS (30-day exploit probability)
- 99.5% · top 1% of all CVEs
- Weakness
- CWE-434
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.