Actively exploited · Published Apr 24, 2025 · Assigned by sap

CVE-2025-31324Missing Authorization check in SAP NetWeaver (Visual Composer development server)

Critical 10.0 Exploited Ransomware

In plain English

A critical-severity unrestricted file upload in SAP NetWeaver (Visual Composer development server) from SAP_SE. Attackers are actively exploiting it in the wild (listed by CISA on April 29, 2025). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)99.5%top 0.1% of all CVEs

Exploited in the wildYesCISA KEV since Apr 29, 2025

Attack tooling2Nuclei, Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by May 20, 2025.

Official description

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP NetWeaver (Visual Composer development server)	VCFRAMEWORK 7.50

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English

CISA guidance

Official description

Affected products (as reported)

References