Vulnerability details
CVE-2025-31324
Actively exploited
SAP_SE SAP NetWeaver
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
CVSS 3.1
10.0Critical
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-05-20)
Official description
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 10.0Critical | 3.1 | CVEProject cvelistV5 (CNA) (sap) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SAP_SE | SAP NetWeaver (Visual Composer development server) | VCFRAMEWORK 7.50 | CVEProject cvelistV5 (CNA) |
References and advisories
6- https://me.sap.com/notes/3594142
- https://url.sap/sapsecuritypatchday
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324 government-resource
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ technical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-04-24
- Last updated
- 2026-08-04
- State
- Published
- Assigner (CNA)
- sap
- Kolun priority
- 80 · Critical
CISA KEV catalog
- Date added
- 2025-04-29
- Due date
- 2025-05-20
- Used in ransomware
- Yes
Exploit prediction (EPSS)
99.48%
Probability of exploitation in 30 days
99.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-434Unrestricted Upload of File with Dangerous Type