SAP NetWeaver CVE-2025-31324

No special conditions beyond reachability - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against SAP NetWeaver AS Java systems where the Visual Composer / VCFRAMEWORK component is deployed and the Metadata Uploader endpoint (/developmentserver/metadatauploader) is network-reachable. The one genuine limiting factor is that Visual Composer must be installed and enabled on the target instance; systems without VCFRAMEWORK deployed, or with the endpoint blocked at the network/proxy layer, are not exploitable. No user interaction, no credentials, and no non-default toggle are required on affected hosts.

Every available signal points to genuine, high-priority risk rather than a paper-high CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes trivial, unauthenticated, low-complexity network exploitation with full impact, and this is corroborated by real-world data: CISA KEV lists it as actively exploited, a public exploit exists, and EPSS sits at 32.16% (97th percentile) - an unusually high probability that reflects broad, ongoing exploitation. The signals are mutually reinforcing and non-conflicting. The only nuance is that Visual Composer must be present/enabled for a given host to be exploitable, so not literally every NetWeaver install is vulnerable; however, given confirmed in-the-wild attacks and webshell-based footholds reported by Onapsis, any internet-reachable NetWeaver Java system should be treated as an emergency until verified patched.

An attacker scans the internet for exposed SAP NetWeaver Java systems and sends an unauthenticated HTTP POST to the Visual Composer Metadata Uploader endpoint, uploading a malicious JSP webshell. They then browse to the uploaded file to execute OS commands as the SAP service account, establishing persistence and pivoting into the SAP landscape. Public exploit code exists and this technique is confirmed to be used in active, in-the-wild attacks.