CVE-2025-31324

VendorsapProductnetweaverDiscoveredApr 24, 2025UpdatedAug 4, 2026

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

View graph Watch Export

CVSS v3.1

10 CRITICAL

EPSS

99.5%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Oct 3, 2026

▼ 0.03pp

99.5% → 99.5% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Connections

8 relationships

CWE-434

source

Timeline

disclosure → media coverage

Apr 24, 2025

Disclosure — published as a CVE record. · last revised by NVD Aug 4, 2026

Jul 29, 2025

infosecurity-magazine.com reports: Auto-Color Backdoor Malware Exploits SAP Vulnerability

Jul 29, 2025

bleepingcomputer.com reports: Hackers exploit SAP NetWeaver bug to deploy Linux Auto-Color malware

Aug 19, 2025

thehackernews.com reports: Public Exploit for Chained SAP Flaws Exposes Unpatched Systems to Remote Code Execution

Aug 20, 2025

helpnetsecurity.com reports: Exploit for critical SAP Netweaver flaws released (CVE-2025-31324, CVE-2025-42999)

Oct 30, 2026

redhotcyber.com reports: Gli hacker criminali violano i dispositivi D-Link e Ubiquiti per trasformarli in proxy residenziali

Public PoC (10)

github.com/rxerium/CVE-2025-31324 github.com/redrays-io/CVE-2025-31324 github.com/Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools github.com/moften/CVE-2025-31324 github.com/moften/CVE-2025-31324-NUCLEI github.com/Alizngnc/SAP-CVE-2025-31324 github.com/ODST-Forge/CVE-2025-31324_PoC github.com/abrewer251/CVE-2025-31324_PoC_SAP github.com/BlueOWL-overlord/Burp_CVE-2025-31324 github.com/nullcult/CVE-2025-31324-File-Upload

Unverified third-party code — review before executing.