Description
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SAP_SE SAP NetWeaver (Visual Composer development server)
Default version status: unaffected
VCFRAMEWORK 7.50affected
References
- https://me.sap.com/notes/3594142 ↗
- https://url.sap/sapsecuritypatchday ↗
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/ ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324 ↗
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/ ↗
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/ ↗