SAP has launched out-of-band emergency NetWeaver updates to repair a suspected distant code execution (RCE) zero-day flaw actively exploited to hijack servers.
The vulnerability, tracked below CVE-2025-31324 and rated important (CVSS v3 rating: 10.0), is an unauthenticated file add vulnerability in SAP NetWeaver Visible Composer, particularly the Metadata Uploader element.
It permits attackers to add malicious executable recordsdata with no need to log in, doubtlessly resulting in distant code execution and full system compromise.
Although the seller’s bulletin is not public, ReliaQuest reported earlier this week about an actively exploited vulnerability on SAP NetWeaver Visible Composer, particularly the ‘/developmentserver/metadatauploader’ endpoint, which aligns with CVE-2025-31324.
ReliaQuest reported that a number of clients had been compromised by way of unauthorized file uploads on SAP NetWeaver, with the attackers importing JSP webshells to publicly accessible directories.
These uploads enabled distant code execution by way of easy GET requests to the JSP recordsdata, permitting command execution from the browser, file administration actions (add/obtain), and extra.
Within the post-exploitation part, the attackers deployed the ‘Brute Ratel’ crimson group instrument, the ‘Heaven’s Gate’ safety bypassing approach, and injected MSBuild-compiled code into dllhost.exe for stealth.
ReliaQuest famous within the report that exploitation didn’t require authentication and that the compromised techniques had been absolutely patched, indicating that they had been focused by a zero-day exploit.
Safety agency watchTowr additionally confirmed to BleepingComputer they’re seeing lively exploitation linked to CVE-2025-31324.
“Unauthenticated attackers can abuse built-in performance to add arbitrary recordsdata to an SAP NetWeaver occasion, which suggests full Distant Code Execution and complete system compromise,” said watchTowr CEO Benjamin Harris.
“watchTowr is seeing lively exploitation by menace actors, who’re utilizing this vulnerability to drop net shell backdoors onto uncovered techniques and achieve additional entry.”
“This lively in-the-wild exploitation and widespread influence makes it extremely seemingly that we’ll quickly see prolific exploitation by a number of events.”
BleepingComputer contacted SAP with questions in regards to the lively exploitation however has not obtained a response at the moment.
Defend towards assaults now
The vulnerability impacts the Visible Composer Framework 7.50 and the really useful motion is to use the most recent patch.
This emergency safety replace was made out there after SAP’s common ‘April 2025’ replace, so should you utilized that replace earlier this month (launched on April 8, 2025), you are still susceptible to CVE-2025-31324.
Furthermore, the emergency replace contains fixes for 2 extra important vulnerabilities, particularly CVE-2025-27429 (code injection in SAP S/4HANA) and CVE-2025-31330 (code injection in SAP Panorama Transformation).
These unable to use the updates that deal with CVE-2025-31324 are really useful to carry out the next mitigations:
- Limit entry to the /developmentserver/metadatauploader endpoint.
- If Visible Composer is just not in use, take into account turning it off totally.
- Ahead logs to SIEM and scan for unauthorized recordsdata within the servlet path.
ReliaQuest recommends performing a deep atmosphere scan to find and delete suspect recordsdata earlier than making use of the mitigations.
Replace 4/25 – A SAP spokesperson disputed by way of a press release to BleepingComputer that CVE-2025-31324 was efficiently exploited in precise assaults.
“SAP was made conscious of a vulnerability in SAP NETWEAVER Visible Composer, which can have allowed unauthenticated and unauthorized code execution in sure Java Servlet,” said the SAP spokesperson.
“SAP is just not conscious that SAP buyer knowledge or techniques had been impacted by these vulnerabilities. A workaround was launched on April 8, 2025, and a patch is at the moment out there. Prospects are really useful to use the patch instantly.”
In the meantime, cybersecurity agency Onapsis, revealed a report saying it additionally noticed lively exploitation.
