CVE-2025-31324

CRITICAL CISA KEV EPSS 99.9%
Published Apr 24, 20251y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Apr 24, 2025 1y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Apr 29, 2025 1y ago
KEV Due May 20, 2025 408d overdue

Description

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

CISA Known Exploited Overdue 408d
Added
Apr 29, 2025
Due
May 20, 2025

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
99.9% percentile
Exploit & Patch Status
Actively Exploited (KEV)
No Patch Available

Weaknesses 1

CWE-434 Unrestricted Upload of File with Dangerous Type Resource Mgmt

Affected Products 1

VendorProductVersionRange
sapnetweaver7.50any

References 6

  • me.sap.com https://me.sap.com/notes/3594142
    Permissions Required
  • onapsis.com https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
    Third Party Advisory
  • url.sap https://url.sap/sapsecuritypatchday
    Vendor Advisory
  • bleepingcomputer.com https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/
    Press/Media Coverage
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324
    US Government Resource
  • theregister.com https://www.theregister.com/2025/04/25/sap_netweaver_patch/
    Press/Media Coverage

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.