CVE-2025-31324

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.995 · 100 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 23 exploits · PoC

Likely / severe?

99.5% (100th) EPSS

CVSS 9.8 · critical

Is it mine?

203 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-04-29remediate by 2025-05-20

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-26

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · cna@sap.comexploitability 3.9 · impact 6

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-434USCWE-434USCWE-434US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (23)

Public proof-of-concept and weaponised exploit code.

affected products (203)

Products and version ranges known to be affected.

SAP Softwareall versionscert_bundDEcpe:/a:sap:sap:-
SAP_SE SAP NetWeaver (Visual Composer development server)≤ VCFRAMEWORK 7.50enisa_euvdEU
SAP SAP NetWeaver≤ VCFRAMEWORK 7.50fstec_bduRU
ATOSS Staff Efficiency Suite≤ vers:unknown/unknownncsc_nlNLcpe:/a:atoss:staff_efficiency_suite:-
Amazon Linux 2≤ vers:unknown/unknownncsc_nlNLcpe:/o:amazon:linux_2:-
BusinessObjects Financial Consolidation≤ vers:unknown/10.1ncsc_nlNLcpe:2.3:a:sap:sap_businessobjects_financial_consolidation:10.1:*:*:*:*:*:*:*
BusinessObjects Financial Consolidation≤ vers:unknown/10.0ncsc_nlNLcpe:2.3:a:sap:sap_businessobjects_financial_consolidation:10.0:*:*:*:*:*:*:*
ERP Financials Information System≤ vers:unknown/2.00ncsc_nlNLcpe:2.3:a:sap_se:sap_erp_financials_information_system:2.00:*:*:*:*:*:*:*
Netweaver System Landscape Directory≤ vers:unknown/7.5ncsc_nlNLcpe:2.3:a:sap:netweaver_system_landscape_directory:7.5:*:*:*:*:*:*:*
SAP Software≤ vers:unknown/*ncsc_nlNLcpe:/a:sap:sap:-
financial_consolidation≤ vers:unknown/1010ncsc_nlNLcpe:2.3:a:sap:financial_consolidation:1010:*:*:*:*:*:*:*
landscape_management≤ vers:unknown/3.0ncsc_nlNLcpe:2.3:a:sap:landscape_management:3.0:*:*:*:*:*:*:*
s4coreop≤ vers:unknown/106ncsc_nlNLcpe:2.3:a:sap:s4coreop:106:*:*:*:*:*:*:*
s4coreop≤ vers:unknown/108ncsc_nlNLcpe:2.3:a:sap:s4coreop:108:*:*:*:*:*:*:*
s4coreop≤ vers:unknown/107ncsc_nlNLcpe:2.3:a:sap:s4coreop:107:*:*:*:*:*:*:*
sap≤ vers:unknown/*ncsc_nlNLcpe:2.3:a:sap:sap:-:*:*:*:*:*:*:*
sap_pdce≤ vers:unknown/s4core_102ncsc_nlNLcpe:2.3:a:sap_se:sap_pdce:s4core_102:*:*:*:*:*:*:*
Apache Tomcat≤ vers:unknown/10.1.17ncsc_nlNL
Apache Tomcat≤ vers:unknown/10.1.16ncsc_nlNL
Apache Tomcat≤ vers:unknown/10.1.1ncsc_nlNL

showing 20 of 203

advisories (4)

Vendor and ecosystem advisories describing this.

NCSC-2025-0119Kwetsbaarheden verholpen in SAP-productenNL2025-04-09csaf · ncsc_nlNL
SAP heeft kwetsbaarheden verholpen in verschillende producten, waaronder SAP Financial Consolidation, SAP Landscape Transformation, SAP NetWeaver Application Server ABAP, SAP Commerce Cloud, SAP ERP BW, SAP BusinessObjects Business Intelligence Platform, SAP KMC WPC, SAP Solution Manager, SAP S4CORE, en SAP CRM.
NCSC-2025-0149Kwetsbaarheden verholpen in SAP productenNL2025-05-13csaf · ncsc_nlNL
SAP heeft meerdere kwetsbaarheden verholpen in diverse SAP producten, zoals NetWeaver, NetWeaver Visual Composer, SAP GUI, pcde, Business Objects, HANA en andere componenten.
WID-SEC-W-2025-0719SAP Patchday April 2025: Mehrere SchwachstellenDeutsch2025-04-07csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.
WID-SEC-W-2025-1002SAP Patchday Mai 2025: Mehrere SchwachstellenDeutsch2025-05-12csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um erweiterte Rechte zu erlangen, beliebigen Code auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl NVD CVE.org MITRE

published 2025-04-24modified 2026-08-04

references (11)

External citations — patches, advisories, analysis.

https://me.sap.com/notes/3594142 cnnvd
https://support.sap.com/en/my-support/software-downloads.htmlPatchcnnvd
https://url.sap/sapsecuritypatchday cnnvd
https://me.sap.com/notes/3594142 enisa_euvd
https://url.sap/sapsecuritypatchday enisa_euvd
https://me.sap.com/notes/3594142Permissions Requirednvd
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/Third Party Advisorynvd
https://url.sap/sapsecuritypatchdayVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan