ClosedCriticalPatched

SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)

SAP NetWeaver Visual Composer

A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.

Why this severity: CVSS 10.0; exploited as zero-day; CISA KEV; known ransomware use

Started: Apr 24, 2025
Closed: Apr 29, 2025
CVE: CVE-2025-31324

Follow this incident

Updated May 15, 2025

Affected

SAP NetWeaver Visual Composer (VCFRAMEWORK); see SAP Security Note

Fixed in

See SAP Security Note for CVE-2025-31324

Timeline3

May 15, 2025
CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV
Apr 29, 2025
CISA adds CVE-2025-31324 to KEV
Apr 24, 2025
SAP releases an emergency fix; ReliaQuest publishes its findings
Source

Advisories2

News & write-ups3

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified