Hackers Exploit Zero-Day Vulnerability in SAP NetWeaver: Urgent Patch Needed

Hackers Exploit Zero-Day Vulnerability in SAP NetWeaver: Urgent Patch Needed

Key points

• Critical zero-day: A zero-day vulnerability in SAP NetWeaver needs immediate attention from organizations that run it.
• Exploited in the wild: Attackers were already using the flaw before a fix was available.
• Emergency patch: SAP has released a fix and urges customers to apply it right away.
• Impact: Unpatched servers can be fully taken over, leading to data theft and disrupted operations.

A maximum-severity SAP flaw

Attackers are exploiting a critical zero-day in SAP NetWeaver, the platform that runs core business processes at many large companies. Enterprise software like this holds finance and HR data. A single exposed server is a serious problem.

What the flaw is

According to reports including The Hacker News, the flaw is in the Visual Composer Metadata Uploader of SAP NetWeaver’s Application Server Java. Tracked as CVE-2025-31324 with a CVSS score of 10.0, it lets an unauthenticated attacker upload files to the server. Attackers have used it to plant web shells and run arbitrary code.

Attacks already under way

Security firm ReliaQuest found the flaw while investigating attacks on customer systems. Exploitation came first. The patch came later, and attackers are now going after every server that has not been updated yet.

Patch now

SAP released an out-of-band fix in Security Note 3594142 on April 24, 2025, and tells customers to apply it without delay. Organizations that cannot patch at once should restrict access to the Metadata Uploader or disable Visual Composer if they do not use it.

Patching closes the hole but does not remove a web shell that is already there. Teams should check their servers for unexpected files in the affected directories.

What is at stake for SAP customers

For companies running NetWeaver, a successful attack could mean stolen data and halted operations. Trust takes longer to repair.

Steps for SAP administrators

The SAP zero-day shows how fast attackers move on flaws in widely used enterprise software. Patch first. Then hunt.

Admins should confirm the fix for CVE-2025-31324 is installed on every Java application server and look for JSP files that should not be there. Logs matter too. Review every request to the Metadata Uploader going back to early April, because attackers were inside some networks weeks before SAP published its note. Regular audits and staff training help with the next one.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.