SAP has launched out-of-band emergency updates for NetWeaver to repair an actively exploited distant code execution (RCE) vulnerability used to hijack servers.
The vulnerability, tracked beneath CVE-2025-31324 and rated vital (CVSS v3 rating: 10.0), is an unauthenticated file add vulnerability in SAP NetWeaver Visible Composer, particularly the Metadata Uploader element.
It permits attackers to add malicious executable information without having to log in, doubtlessly resulting in distant code execution and full system compromise.
Although the seller’s bulletin is not public, ReliaQuest reported earlier this week about an actively exploited vulnerability on SAP NetWeaver Visible Composer, particularly the ‘/developmentserver/metadatauploader’ endpoint, which aligns with CVE-2025-31324.
ReliaQuest reported that a number of prospects had been compromised through unauthorized file uploads on SAP NetWeaver, with the attackers importing JSP webshells to publicly accessible directories.
These uploads enabled distant code execution through easy GET requests to the JSP information, permitting command execution from the browser, file administration actions (add/obtain), and extra.
Within the post-exploitation part, the attackers deployed the ‘Brute Ratel’ pink group device, the ‘Heaven’s Gate’ safety bypassing method, and injected MSBuild-compiled code into dllhost.exe for stealth.
ReliaQuest famous within the report that exploitation didn’t require authentication and that the compromised techniques had been absolutely patched, indicating that they had been focused by a zero-day exploit.
Safety agency watchTowr additionally confirmed to BleepingComputer they’re seeing energetic exploitation linked to CVE-2025-31324.
“Unauthenticated attackers can abuse built-in performance to add arbitrary information to an SAP NetWeaver occasion, which implies full Distant Code Execution and complete system compromise,” said watchTowr CEO Benjamin Harris.
“watchTowr is seeing energetic exploitation by menace actors, who’re utilizing this vulnerability to drop internet shell backdoors onto uncovered techniques and acquire additional entry.”
“This energetic in-the-wild exploitation and widespread influence makes it extremely seemingly that we’ll quickly see prolific exploitation by a number of events.”
BleepingComputer contacted SAP with questions concerning the energetic exploitation however has not obtained a response presently.
Defend towards assaults now
The vulnerability impacts the Visible Composer Framework 7.50 and the really helpful motion is to use the newest patch.
This emergency safety replace was made accessible after SAP’s common ‘April 2025’ replace, so should you utilized that replace earlier this month (launched on April 8, 2025), you are still susceptible to CVE-2025-31324.
Furthermore, the emergency replace consists of fixes for 2 extra vital vulnerabilities, particularly CVE-2025-27429 (code injection in SAP S/4HANA) and CVE-2025-31330 (code injection in SAP Panorama Transformation).
These unable to use the updates that tackle CVE-2025-31324 are really helpful to carry out the next mitigations:
- Prohibit entry to the /developmentserver/metadatauploader endpoint.
- If Visible Composer is just not in use, think about turning it off totally.
- Ahead logs to SIEM and scan for unauthorized information within the servlet path.
ReliaQuest recommends performing a deep setting scan to find and delete suspect information earlier than making use of the mitigations.
