CVE-2025-31324 is a missing-authorization flaw in the Metadata Uploader of SAP NetWeaver Visual Composer that lets a remote, unauthenticated attacker upload malicious executable files — including JSP webshells — to the server, and it was exploited as a zero-day in the wild by multiple threat actors, including ransomware groups, before SAP shipped a patch.
Vulnerability summary
9.8
Critical
99.5%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-04-24
Published
Vulnerability ID: CVE-2025-31324 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| SAP NetWeaver Visual Composer (VCFRAMEWORK) | cpe:2.3:a:sap:netweaver:7.50:*:*:*:*:*:*:* | NetWeaver Application Server Java 7.50 running the Visual Composer development server (Metadata Uploader servlet, component VCFRAMEWORK); patched by SAP Security Note 3594142 (2025-04-24), with a follow-up root-cause fix for the underlying deserialization issue in Security Note 3604119 (2025-05-13, tracked separately as CVE-2025-42999). Systems that do not need Visual Composer can remove the component entirely as a workaround. |
What this means
CVE-2025-31324 (CWE-434, unrestricted upload of a file with a dangerous type) is in the Metadata Uploader component of SAP NetWeaver Visual Composer. NVD's description states the uploader "is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system," significantly affecting confidentiality, integrity and availability (NVD).
NVD's own analysis and the SAP CNA submission agree on severity: CVSS v3.1 base score 9.8 (critical) from NVD, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required. SAP's own CNA submission scores the same flaw 10.0 with scope changed (S:C), reflecting that a compromised Visual Composer server gives full control over the NetWeaver Java stack it runs on (NVD).
CISA added CVE-2025-31324 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-04-29, just five days after the patch, with known use in ransomware campaigns and a required-action due date of 2025-05-20 (CISA KEV).
Incident-response firm Onapsis, which worked the active-exploitation cases, reports that exploitation began well before public disclosure — as early as January 2025 — and that attackers planted webshells (observed filenames include helper.jsp and cache.jsp) on hundreds of internet-facing SAP systems worldwide; activity included both opportunistic scanning and operations attributed to ransomware-affiliated and nation-state-linked groups, with a second wave of attacks continuing into late May 2025 after the patch shipped (Onapsis: Active Exploitation of SAP Vulnerability CVE-2025-31324).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.99486 (99.944th percentile), among the highest EPSS scores tracked, consistent with a flaw that remains a priority target over a year after disclosure (FIRST EPSS).
Because Visual Composer is bundled with, but not always actively used by, many NetWeaver Java installs, SAP customers should apply Security Notes 3594142 and 3604119 immediately, or remove the Visual Composer component on systems that do not need it, and check for webshells and unexpected JSP files given the documented history of pre-patch exploitation.
Evidence
- Missing authorization check in SAP NetWeaver Visual Composer's Metadata Uploader lets an unauthenticated remote attacker upload malicious executable binaries, severely affecting confidentiality, integrity and availability. — NVD
- CVSS v3.1 base score is 9.8 (critical, NVD Primary), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; SAP's own CNA submission scores it 10.0 with scope changed. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-04-29, due date 2025-05-20, with known ransomware campaign use. — CISA KEV
- Exploitation began before public disclosure (as early as January 2025); attackers planted webshells (e.g. helper.jsp, cache.jsp) on hundreds of internet-facing SAP systems, with activity from ransomware-affiliated and nation-state-linked groups continuing into late May 2025. — Onapsis: Active Exploitation of SAP Vulnerability CVE-2025-31324
- EPSS score is 0.99486 (99.944th percentile) as of 2026-10-29. — FIRST EPSS
