by Kastro
Paper/Archive/CVE-2025-31324

CVE-2025-31324

SAP_SE SAP NetWeaver (Visual Composer development server) — Missing Authorization check in SAP NetWeaver (Visual Composer development server)

KEV · due 20 Mayransomware useEPSS 99%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

Affected

ProductAffectedFixed inSource
SAP NetWeaver (Visual Composer development server)VCFRAMEWORK 7.50–CNA

Scores by source

sap (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refme.sap.com/notes/3594142refurl.sap/sapsecuritypatchdaywriteuponapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324reftheregister.com/2025/04/25/sap_netweaver_patchrefbleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attackskevcisa.gov/known-exploited-vulnerabilities-catalog