SAP has released out-of-band patch to address CVE-2025-31324, a critical zero-day vulnerability in SAP NetWeaver that has been exploited by threat actors. Organizations are strongly encouraged to apply patches as soon as possible.

CVE-2025-31324: Zero-Day Vulnerability in SAP NetWeaver Exploited in the Wild

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

A new exploit chain targeting CVE-2025-31324 and CVE-2025-42999 has been observed. Patches are available and should be applied quickly

Exploitation has been observed and an emergency out-of-band patch from SAP has been released to address this critical vulnerability. Immediate patching is recommended.

SAP NetWeaver Visual Composer is affected by multiple vulnerabilities, including the following:

  - SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user     can upload untrusted or malicious content which, when deserialized, could potentially     lead to a compromise of confidentiality, integrity, and availability of the host system.
    (CVE-2025-42999)

  - SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an     authenticated attacker with SAP standard authorization to execute a certain function module     remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due     to lack of input validation and no authorization checks. This has low Confidentiality impact     but high impact on integrity and availability to the application.
    (CVE-2025-43010)

  - Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform     the necessary authorization checks, allowing authenticated users to access restricted     functionalities or data. This can lead to a high impact on confidentiality with no impact     on the integrity or availability of the application.
    (CVE-2025-43011)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

SAP NetWeaver Visual Composer Metadata Uploader is affected by an improper authorization vulnerability allowing an unauthenticated attacker to upload arbitrary files allowing to achieve a Remote Code Execution.

The remote SAP NetWeaver Visual Composer Metadata Uploader enpoint is potentially affected by an improper authorization vulnerability:

  - SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing     unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host     system. This could significantly affect the confidentiality, integrity, and availability of the targeted     system. (CVE-2025-31324)

ID	Name	Product	Family	Severity
236840	SAP Netweaver Visual Composer Multiple Vulnerabilities (May 2025)	Nessus	Web Servers	critical
114785	SAP NetWeaver Visual Composer Metadata Uploader Arbitrary File Upload	Web App Scanning	Component Vulnerability	critical
234846	SAP NetWeaver Visual Composer Metadata Uploader Improper Authorization (CVE-2025-31324) (Direct Check)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2025-31324

critical

Tenable Plugins

critical

critical

critical