CVE-2025-31324: SAP NetWeaver Visual Composer unauthenticated file upload to RCE, actively exploited
The short version: SAP NetWeaver's Visual Composer Metadata Uploader is missing a proper authorization check (CVE-2025-31324), so an unauthenticated attacker can upload a malicious executable — typically a web shell — and take control of the server. SAP scores it a perfect 10.0, it was exploited in the wild, and it's in CISA's KEV catalog. If you run NetWeaver Visual Composer, this is patch-and-verify, not patch-and-forget. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (SAP, CNA) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 99.41% · 99.94th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-05-20 |
| Known exploited? | Yes — exploited in the wild to deploy web shells |
| Vulnerability type | CWE-434 unrestricted file upload → remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | SAP NetWeaver Visual Composer (VCFRAMEWORK 7.50) |
| Fixed in | Per SAP Security Note 3594142 |
What you need to know
The Metadata Uploader endpoint (/developmentserver/metadatauploader) doesn't enforce authorization. An unauthenticated attacker uploads an executable file — commonly a JSP/JavaScript web shell — and then runs it, gaining command execution on the NetWeaver host.
This is about as bad as external exposure gets:
- It's pre-authentication and network-reachable. No credentials, and the upload path is a known, fixed URL.
- The target is an enterprise application server. Code execution there reaches business-critical data and can seed lateral movement — NVD marks confidentiality, integrity, and availability all High, and SAP raises scope to Critical for a 10.0.
- It was live in the wild. Attackers used it to drop web shells on exposed systems, so an affected server may have been touched before you patched.
How serious we see it
Moderate — the 10.0 is not hyperbole here.
Unauthenticated file upload leading to code execution on a NetWeaver server, confirmed exploited, with EPSS at the ceiling, is textbook top-of-queue. The bounded, reassuring part is that it's specific and fixable: it affects Visual Composer on a defined product line, SAP has published the fix, and exposure is quick to determine. The catch is the familiar one for any actively exploited flaw — being patched and being clean are separate questions.
Recommendations
Straight from SAP's guidance and CISA:
- Patch now. Apply SAP Security Note 3594142 to remediate the Visual Composer upload flaw.
- Restrict the endpoint. If you can't patch immediately, block or restrict access to
/developmentserver/metadatauploaderand limit NetWeaver's internet exposure. - Hunt for web shells. Given in-the-wild use, check for unexpected files under the servlet paths and for anomalous process/network activity.
- If compromised, respond fully. Remove shells, rebuild where warranted, and rotate credentials, keys, and secrets reachable from the host.
- Confirm your exposure first. Verify whether you run an internet-facing NetWeaver with Visual Composer at all.
How BreachRisk sees it
BreachRisk works this from the outside in. From little more than your domain it discovers exposed SAP NetWeaver, and because this threat is safely testable, it goes beyond a banner: within bounded, non-disruptive limits it sends a single benign request to the affected endpoint to confirm whether it's reachable — a check, not an upload — turning "this looks like NetWeaver" into a verified exposure. KEV-listed findings like this rise to the top, so an exposed, exploitable NetWeaver is flagged and confirmed rather than waiting in a scanner backlog.