CVE-2025-31324

CRITICALCVSS 10.0Known Exploited

CISA Known Exploited Vulnerability

https://me.sap.com/notes/3594142 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31324

Remediation deadline: May 20, 2025

Ransomware use: Known

Description

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.

Timeline

Published:April 24th, 2025 5:15 PM

Last modified:August 4th, 2026 5:16 AM

Added to KEV:April 29th, 2025

CVSS Scoring

CVSS v3: 10.0 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

sap

Products

netweaver

Weaknesses (CWE)

CWE-434

References & Reports

Advisories, patches, and third-party reports

https://me.sap.com/notes/3594142Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/Third Party Advisory
https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/Press/Media Coverage
https://www.theregister.com/2025/04/25/sap_netweaver_patch/Press/Media Coverage
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324US Government Resource

Source: NIST NVD · Data may lag official sources by up to one minute