SAP · NetWeaver
The flaw lies in the Visual Composer Metadata Uploader component of SAP NetWeaver, which is not protected by proper authorization checks. An unauthenticated attacker over the network can exploit it, with no user interaction required, to upload potentially malicious executable files to the host system, which could compromise its confidentiality, integrity, and availability.
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
First seen exploited 2 days before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 1 day after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Attackers have exploited this SAP vulnerability to achieve remote code execution on the target system by sending malicious ZIP files to specific server endpoints. This can be done either through use of a single command or by uploading a web shell.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2025-31324 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
ContentDownloadUsingPowershell l DataExfiltrationusingrclone l DCSyncAttackBehavior l DLLFileConnectedtoaRawIPAddress l DownloadofExecutableFilesusingWebDAV l EndpointExfiltrationofAWSCredentials l ExecutionofAdFindBinaryforDiscovery l ExecutionsofFilefromRecycleBin l ExploitationofWebShellthroughCVE-2025-31324…
3 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.