Dozens of SAP NetWeaver instances are susceptible to compromise after a threat actor released a new working exploit that chains two critical-severity vulnerabilities for code execution. The flaws, tracked as CVE-2025-31324 (CVSS score of 10) and CVE-2025-42999 (CVSS score of 9.1), are described as a missing authorization check issue and an insecure deserialization bug, and were resolved with security notes released in April and May, respectively. Both security defects had been exploited in the wild before fixes were rolled out for them, for the deployment of web shells and remote command execution. Ransomware groups such as BianLian and RansomEXX, and Chinese APTs were seen targeting them. On Friday, threat intelligence and research project Vx-Underground warned that someone apparently…