What is the CVSS score of CVE-2025-31324?

CVE-2025-31324 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 32.2%.

Which versions of SAP NetWeaver are affected by CVE-2025-31324?

SAP NetWeaver Visual Composer contains a critical unauthenticated remote code execution vulnerability (CVE-2025-31324) that is confirmed actively exploited (CISA KEV), allowing attackers to gain…

Is there a public PoC exploit available for CVE-2025-31324?

Yes, a public proof-of-concept exploit is available for CVE-2025-31324. Prioritise patching immediately. EPSS: 32.2%.

How to fix or mitigate CVE-2025-31324?

Within 24 hours, conduct immediate asset discovery to identify and isolate all internet-exposed SAP NetWeaver Application Server Java instances from public internet access. Within 7 days, implement compensating controls including Web Application Firewall (WAF) rules to restrict Visual Composer Metadata Uploader access, network segmentation to limit component exposure to trusted sources only, and disable Visual Composer entirely if not operationally required. Within 30 days, establish communication with SAP support to obtain patch timeline and availability status, evaluate NetWeaver version upgrades as a potential remediation path, and implement continuous monitoring for exploitation attempts and unauthorized code execution on affected systems.

SAP NetWeaver CVE-2025-31324

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-04-24 cna@sap.com

SAP File Upload Netweaver

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network upload with no user interaction (AV:N/AC:L/PR:N/UI:N) yields webshell code execution, giving full confidentiality, integrity, and availability impact on the host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 05:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Aug 04, 2026 - 05:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Mar 28, 2026 - 18:38 vuln.today

Added to CISA KEV

Oct 31, 2025 - 21:56 cisa

CISA KEV

CVE Published

Apr 24, 2025 - 17:15 nvd

CRITICAL 10.0

DescriptionNVD

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

AnalysisAI

Unauthenticated remote code execution in SAP NetWeaver Visual Composer (Metadata Uploader component) allows attackers to upload arbitrary executable binaries to the host without any authentication, leading to full system compromise. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and Onapsis and multiple outlets report opportunistic attacks against internet-exposed NetWeaver Application Server Java systems. Its 97th-percentile EPSS (32.16%) and 9.8 CVSS underline it as a top-priority, mass-exploitable vulnerability.

Technical ContextAI

SAP NetWeaver Application Server Java hosts the Visual Composer development environment, whose Metadata Uploader endpoint (part of the VCFRAMEWORK / developmentserver metadatauploader path) accepts file uploads. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the endpoint performs no proper authorization check and does not validate the type of uploaded content, so an attacker can deposit an executable payload - typically a JSP webshell - into a web-accessible directory and then invoke it. Because NetWeaver AS Java serves these files through its own servlet engine, an uploaded webshell executes with the privileges of the SAP application server process, giving code execution on the host. Visual Composer is not installed by default on every NetWeaver system but is enabled in a very large share of real-world deployments.

RemediationAI

Apply SAP Security Note 3594142 immediately (see https://me.sap.com/notes/3594142 and the SAP Security Patch Day advisory at https://url.sap/sapsecuritypatchday); the note lists the exact corrective support-package and patch levels for affected NetWeaver AS Java releases - apply those precise versions rather than any guessed number. Where patching cannot be done instantly, SAP and Onapsis recommend compensating controls: restrict or block external access to the vulnerable endpoints /developmentserver/metadatauploader and the Visual Composer paths (e.g., via reverse proxy / SAP Web Dispatcher rules or WAF), and if Visual Composer is not needed, disable or undeploy the VCFRAMEWORK application entirely (trade-off: breaks any Visual Composer-based content/models still in use). Additionally hunt for indicators of prior compromise - search web-accessible directories (e.g., irj/servlet_jsp and related paths) for unexpected JSP/webshell files, since public exploitation predates patching. Reference the Onapsis analysis (https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/) for IOCs and hunting guidance.