SAPExploited incident
SAP NetWeaver Visual Composer zero-day unrestricted file upload (CVE-2025-31324)
CVE-2025-31324Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 29 Apr 2025
- Exploited before a fix
- Known ransomware use
Response
- Silence
- 2d First public report to first vendor statement
- Exposure
- 2d First public report to first fix
- Follow-through
- 2d First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
date only
ReliaQuest Threat Spotlight: SAP NetWeaver compromiseCuratedQuote verified
Published on April 22, 2025
ReliaQuest publicly reported webshell uploads via /developmentserver/metadatauploader on fully patched systems. Onapsis's timeline also says 'First public report was via a public blog posted by security research firm ReliaQuest on April 22, 2025.'
- Source
- ReliaQuest Threat Spotlight: SAP NetWeaver compromise research
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:dbff9242c7d8e2e0…- Used in metrics
- Yes
5 more sources for this moment
CVE.org record CVE-2025-31324ClaimedQuote verified24 Apr 2025, 16:50 UTC
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely
CVE record published.
- Source
- CVE.org record CVE-2025-31324 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:dd98a2eaee443076…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet24 Apr 2025, 18:14 UTC
CVE-2025-31324 - SAP NetWeaver Unauthenticated Remote Code Execution
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Mastodon postClaimedQuote not checked yet25 Apr 2025, 13:12 UTC
already being breached, is your enterprise ready to patch this ticking time bomb? https:// thedefendopsdiaries.com/addres sing-cve-2025-31324-a-critical-sap-netweaver-vulnerability/ # sapnetweaver # cve202531324 # cybersecurity # vulnerabilitymanagement # remotecodeexecution
Earliest third-party post we hold.
- Source
- Mastodon post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
CISA KEV (CVE-2025-31324)ClaimedQuote verified29 Apr 2025
SAP NetWeaver Unrestricted File Upload Vulnerability
Added to CISA's KEV catalog on 2025-04-29.
- Source
- CISA KEV (CVE-2025-31324) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Hacker NewsClaimedQuote not checked yet30 Jul 2025, 10:24 UTC
Auto-Color Backdoor Targets U.S. Chemical Firm via CVE-2025-31324
Earliest third-party post we hold.
- Source
- Hacker News hn
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Vendor statement
+2d
CVE-2025-31324 record published by SAP (CNA)CuratedQuote verified
"datePublished":"2025-04-24T16:50:27.706Z"
SAP is the CNA; its public CVE record (referencing SAP Note 3594142) is the first public vendor acknowledgement found. Onapsis says SAP updated KBA 3593336 on 2025-04-22 to link it to the campaign, but SAP KBAs are customer-only, so that is not counted as public.
- Source
- CVE-2025-31324 record published by SAP (CNA) cve record
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:dd98a2eaee443076…- Used in metrics
- Yes
First workaround
No official mitigation found yet.
First fix
date only+2d
Onapsis Research Labs: CVE-2025-31324 and CVE-2025-42999 explainedCuratedQuote verified
SAP rapidly released an emergency patch for this issue on April 24, 2025 at approximately 1:00 PM EST (US).
Out-of-band SAP Security Note 3594142 (after the 2025-04-08 Patch Day). Kept at day precision because Onapsis says 'approximately'. ReliaQuest's page carries SAP's statement: 'A security patch was released on April 24, 2025.'
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:692927f2f9ab919a…- Used in metrics
- Yes
1 more source for this moment
ReliaQuest Threat Spotlight (editor's note)CuratedQuote verified24 Apr 2025
A security patch was released on April 24, 2025.
- Source
- ReliaQuest Threat Spotlight (editor's note) research
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:dbff9242c7d8e2e0…- Used in metrics
- No, kept for the record
Fixed for all versions
date only+2d
Onapsis Research Labs: CVE-2025-31324 and CVE-2025-42999 explainedCuratedQuote verified
SAP rapidly released an emergency patch for this issue on April 24, 2025 at approximately 1:00 PM EST (US).
SAP Note 3594142 covers the only supported affected line listed by SAP, 'Versions - VCFRAMEWORK 7.50' (April 2025 Patch Day page: '[CVE-2025-31324] Missing Authorization check in SAP NetWeaver (Visual Composer development server)'). Older NetWeaver Java releases (7.40 and below) are out of support and get workarounds only (Onapsis).
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:692927f2f9ab919a…- Used in metrics
- Yes
Send this to your boss
SAP NetWeaver Visual Composer flaw exploited before fix; patched April 24, 2025
Attackers used a missing-authorization flaw in SAP NetWeaver Visual Composer to upload web shells without logging in, starting before SAP's emergency patch on April 24, 2025; a related flaw used in the same attacks was fixed on May 13, 2025 (CVE-2025-42999).
In plain words
SAP NetWeaver, which runs core business systems at many large companies, had a flaw that let attackers plant hidden back doors without a password. Attacks began by March 2025, before SAP released an emergency fix on April 24, 2025; from May 2025, researchers linked some of the attacks to ransomware groups. A second, related fix followed on May 13, 2025. If we use SAP NetWeaver with Visual Composer, we need both fixes installed and a check that no back doors were planted before patching.
What happened and who is affected
What happened
Attackers uploaded web shells to internet-facing SAP NetWeaver Java systems through the Visual Composer Metadata Uploader (CVE-2025-31324, CVSS 10.0); Mandiant's first known exploitation was March 12, 2025. ReliaQuest reported the attacks publicly on April 22, 2025 and SAP released emergency Security Note 3594142 on April 24, 2025. From May 2025, researchers attributed some of the attacks to ransomware groups. A related deserialization flaw used in the same attacks (CVE-2025-42999) was fixed on May 13, 2025.
Who is affected
SAP NetWeaver Application Server Java systems with the Visual Composer framework (VCFRAMEWORK 7.50) installed, especially those reachable from the internet. Visual Composer is not installed by default. According to Onapsis, NetWeaver Java 7.40 and earlier are out of support and receive no update, so they need SAP's workarounds.
Affected products
- SAP NetWeaver (Visual Composer development server, VCFRAMEWORK 7.50)
How we built this timeline
Correction pass 23 Oct 2026: split under R7. CVE-2025-42999 was disclosed 13 May 2025, 19 days after this CVE (24 Apr 2025), so it is now its own incident (sap-cve-2025-42999) although the two were exploited together;
Fixed for all versions is now 24 Apr 2025 (VCFRAMEWORK 7.50, the only supported affected line) instead of 13 May 2025. Brief corrected: the '7.40 and below get no patch' claim is now attributed to Onapsis ('SAP NetWeaver Application Server Java 7.40 or below versions are not supported and do not receive updates.'), and for_your_boss separates the March 2025 exploitation from the ransomware attribution, which ReliaQuest added on 14 May 2025 (Onapsis: 'On May 14, 2025, ReliaQuest updated their blogpost noting that further investigation uncovered evidence from the initial exploitation that they attribute to Russian ransomware groups, BianLian and RansomEXX').
Exploitation before the patch (R4 true): Onapsis quotes Mandiant's first known exploitation on 12 Mar 2025 and Rapid7's 'at least March 27, 2025'; ReliaQuest's public report (22 Apr 2025) preceded the fix.
SAP Notes and KBAs are behind SAP login, so research blogs and SAP's public CVE record and Patch Day pages are cited. No public workaround date could be evidenced: KBA 3593336 workarounds existed before 30 Apr 2025 (when 'Option 0' was added, per Onapsis) but their first date is not public.
Onapsis says SAP updated KBA 3593336 on 22 Apr 2025, but KBAs are customer-only, so that is not counted as a Vendor statement moment. CVSS 10.0 from SAP (CNA). ransomware=true follows KEV ('Known').