CVE-2025-31324

EUVD-2025-11987
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
sapCNA
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
Affected Products (NVD)
VendorProductVersion
sapnetweaver
7.50
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://me.sap.com/notes/3594142
https://url.sap/sapsecuritypatchday
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/
https://www.theregister.com/2025/04/25/sap_netweaver_patch/
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324