CVE entry · CVE-2025-31324
CVE-2025-31324: SAP NetWeaver Unrestricted File Upload Vulnerability
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
- Actively exploited: added to CISA’s KEV catalog on April 29, 2025.
- Used by ransomware, according to CISA.
- Remediation deadline for US federal agencies: May 20, 2025.
- CERT-FR alert CERTFR-2025-ALE-005 of April 28, 2025.
Description from CISA’s KEV catalog.
CERT-FR alerts and notices
-
CERTFR-2025-ALE-005Vulnérabilité dans SAP NetWeaver (28 avril 2025)
What to do
- Check whether your estate includes SAP NetWeaver, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.