Critical severity · published Apr 24, 2025
CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
RansomwareIn wildKEV
9.8
CVSS
99.5%
EPSS
Yes
On KEV
Description
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 29, 2025
Federal remediation dueMay 20, 2025
Ransomware campaign useKnown
Affected products
Which versions
SN
SAP NetWeaver (Visual Composer development server) · SAP_SE
VCFRAMEWORK 7.50 · source: vendor
NE
Netweaver · Sap
7.50 · source: NVD, KEV
Affected product
SN
SAP NetWeaver (Visual Composer development server)
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-31324
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-31324
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
me.sap.com
https://me.sap.com/notes/3594142
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver (Visual Composer development server)
9.1
CVE-2025-42999
Insecure Deserialization in SAP NetWeaver (Visual Composer development server)