Table of contents
- A dangerous flaw undermines SAP NetWeaver
- The hidden threat in metadata loading
- Full system control: the real risks of a successful attack
- The connection to recent webshell infections
- A prime target for global cybercrime
A dangerous flaw undermines SAP NetWeaver
The SAP NetWeaver platform is under siege due to a newly discovered zero-day vulnerability, identified as CVE-2025-31324. Scoring a perfect 10 out of 10, this bug forced SAP to release an unscheduled emergency patch.
Experts believe the flaw has already been exploited, although SAP has limited access to details, sharing them only with premium customers.
The hidden threat in metadata loading
According to the National Vulnerability Database (NVD), the flaw affects the metadata loading component in SAP’s no-code application builder, Visual Composer.
Insufficient authorization checks allow unauthenticated attackers to upload potentially malicious executable files, severely threatening the system’s confidentiality, integrity, and availability.
Full system control: the real risks of a successful attack
Onapsis, a cyber security leader for SAP systems, confirms that the bug has already been used in real-world zero-day attacks.
Successful exploitation could grant attackers complete access to business data and processes, enabling ransomware deployment and lateral movement within corporate networks. Immediate patching and system audits are strongly recommended.
The connection to recent webshell infections
ReliaQuest linked this vulnerability to a series of recent SAP breaches, where attackers used JSP-based webshells to upload files and execute code.
Sophisticated techniques, including the use of Brute Ratel and Heaven’s Gate methods, helped bypass detection systems.
A prime target for global cybercrime
With major corporations and government entities (including the UK Government) relying on SAP, such a vulnerability offers cybercriminals an irresistible opportunity.
An unchecked zero-day could trigger devastating global cyber security incidents.
