Article
Exploited vulnerabilities in 2025: what ENISA reports
This is a short list of what ENISA reports about exploited vulnerabilities in 2025. It draws on chapter 7 and the overview of the…
Read more
Exploited vulnerability
SAP NetWeaver Visual Composer upload flaw (CVE-2025-31324)
CVE-2025-31324
CVE-2025-31324 is a flaw in the Visual Composer part of SAP NetWeaver.
- On CISA KEV
- CVE ID
- CVE-2025-31324
- CISA KEV
- Listed
- Affected product
- SAP NetWeaver (Visual Composer development server)
- Exploited
- Yes
- Published
- April 2025
In short
CVE-2025-31324 is a flaw in the Visual Composer part of SAP NetWeaver. A web upload function has no proper permission check, so anyone can upload files, including programs, to the server. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2025-31324
- ProductSAP SAP NetWeaver (Visual Composer development server)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedApply SAP Security Notes · Reduce exposure
What it allows
An unauthenticated attacker can upload potentially malicious executable files to the server, which can harm confidentiality, integrity and availability of the host. SAP rates it 10.0 on CVSS v3.1, and NVD's own score is 9.8. A second flaw, CVE-2025-42999, is a deserialization issue (the server rebuilds objects from untrusted data) in the same component. It needs a privileged account, and SAP's May 2025 fix removes the risk left after the first patch.
Who is affected
Per the CVE record published by SAP, SAP NetWeaver (Visual Composer development server), version VCFRAMEWORK 7.50. The Canadian Centre for Cyber Security says to review SAP Security Notes 3594142 and 3604119, which hold the fixes. The notes sit behind an SAP customer login.
SAP released an emergency update on 24 April 2025, the date NVD published the record. CISA added CVE-2025-31324 to its Known Exploited Vulnerabilities (KEV) catalog on 29 April 2025, and flags known use in ransomware campaigns. CISA added CVE-2025-42999 on 15 May 2025, also flagged for ransomware use.
The Canadian Centre for Cyber Security said it was aware of reports that the flaw had been exploited since March 2025, before the patch existed. It lists reported indicators of compromise in third-party reports. The official sources opened here do not name which actors used the flaw, so no actor is attributed on this page.
What to do
-
Apply SAP Security Notes
Install the fix in SAP Security Note 3594142, and the May 2025 fix in Note 3604119 for CVE-2025-42999. You need an SAP customer account to open them.
-
Reduce exposure
Visual Composer is a development component. If you do not use it, remove it, and keep the NetWeaver web interface off the internet.
-
Assume compromise if exposed before patching
Exploitation began before the patch, so servers that were internet-facing in March and April 2025 should be checked even if now patched.
-
Detect and hunt
Look for unexpected files and executables in the NetWeaver application directories, unusual requests to the Visual Composer upload path, and new processes started by the SAP service. The Canadian Centre for Cyber Security points to published indicators.
Questions
What is CVE-2025-31324?
It is a flaw in the Visual Composer part of SAP NetWeaver. A web upload function lacks a proper permission check, so an unauthenticated attacker can upload potentially malicious executable files to the server, harming its confidentiality, integrity and availability.
Was CVE-2025-31324 exploited before the patch?
Yes. The Canadian Centre for Cyber Security said it was aware of reports that the flaw had been exploited since March 2025, before SAP released its emergency update on 24 April 2025. Servers that were internet-facing in March and April 2025 should be checked.
How do I fix CVE-2025-31324?
Install the fix in SAP Security Note 3594142, and the May 2025 fix in Note 3604119 for CVE-2025-42999. Both need an SAP customer login. If you do not use Visual Composer, remove it, and keep the NetWeaver web interface off the internet.
In our research
Sources
- CVE-2025-31324 record (CVE Program) MITRE / SAP CNA
- CVE-2025-31324 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
- Vulnerabilities impacting SAP NetWeaver (CVE-2025-31324 and CVE-2025-42999) Canadian Centre for Cyber Security
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.