# SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324) · pwn.watch

> A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.

Page: https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324 · generated 2026-10-22T20:45:43.249Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: SAP NetWeaver Visual Composer
- Started: 2025-04-24 · closed: 2025-04-29
- CVEs: CVE-2025-31324
- Affected: SAP NetWeaver Visual Composer (VCFRAMEWORK); see SAP Security Note
- Fixed in: See SAP Security Note for CVE-2025-31324

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324/feed.xml
- JSON Feed: https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324.json
- This file: https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324/llms.txt

## Updates (newest first)
- 2025-05-15: CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV
- 2025-04-29: CISA adds CVE-2025-31324 to KEV
- 2025-04-24: SAP releases an emergency fix; ReliaQuest publishes its findings (https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/)

## Fix brief
# Security brief: SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)

Source: https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324 · status: closed (closed Apr 29, 2025) · severity: critical · updated May 15, 2025

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.

Severity detail: CVSS 10.0; exploited as zero-day; CISA KEV; known ransomware use

- Product: SAP NetWeaver Visual Composer
- CVE / advisory ids: CVE-2025-31324

## Affected versions
- SAP NetWeaver Visual Composer (VCFRAMEWORK); see SAP Security Note

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- See SAP Security Note for CVE-2025-31324

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- May 15, 2025: CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV
- Apr 29, 2025: CISA adds CVE-2025-31324 to KEV
- Apr 24, 2025: SAP releases an emergency fix; ReliaQuest publishes its findings

## Advisories
- [NVD: CVE-2025-31324](https://nvd.nist.gov/vuln/detail/CVE-2025-31324) (NVD)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)

## Write-ups & news
- [ReliaQuest Uncovers New Critical Vulnerability in SAP NetWeaver](https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/)
- [SAP fixes suspected NetWeaver zero-day exploited in attacks](https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/)
- [Onapsis/Mandiant CVE-2025-31324 compromise assessment tool](https://github.com/Onapsis/Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment)

---
Machine-readable: https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.