SAP NetWeaver Faces Urgent Security Crisis Amid Exploitation Threats

Key facts

• SAP NetWeaver Visual Composer has a critical flaw, CVE-2025-31324, that attackers are already exploiting.
• The bug lets an unauthenticated attacker upload files, such as web shells, to an exposed server.
• SAP released an emergency fix (Security Note 3594142) on April 24, 2025.
• Teams should patch or disable Visual Composer now and check servers for files they did not put there.

Why this SAP flaw is urgent

SAP NetWeaver runs core business applications at thousands of large companies, so a remotely exploitable bug in it gets attention fast. This one has a CVSS score of 10.0, the maximum, and it was being exploited before a patch existed.

How attackers are using CVE-2025-31324

Inside the Visual Composer flaw

The flaw is a missing authorization check. An attacker who can reach the Visual Composer endpoint over the network does not need to log in to upload files to the server. ReliaQuest, which disclosed the attacks on April 22, 2025, found JSP web shells dropped into a publicly reachable directory on compromised systems, giving attackers a way to run commands at will.

What attackers can do with it

A web shell on an SAP server is about as bad as access gets. Attackers can run commands with the privileges of the SAP application, read or change business data and use the server as a foothold to move deeper into the network. The financial and reputational damage from that kind of access can be severe.

What SAP customers should do

Fixing it

Apply SAP Security Note 3594142, released April 24, 2025. If you can’t patch right away, SAP’s guidance is to restrict access to the vulnerable Visual Composer endpoint or disable Visual Composer if you don’t use it. Many organizations don’t.

Checking for compromise

Patching does not remove a web shell that is already there. Look for unexpected .jsp, .java or .class files in the servlet_jsp IRJ root and work directories, and review web server logs for upload requests to the Metadata Uploader. Treat any hit as an incident.

What to tell the SAP owner

Internet-facing SAP systems are a favorite target because they hold the data attackers want most. The short version for whoever owns SAP in your organization: confirm whether Visual Composer is installed, patch or disable it today and have someone check for planted files before calling it done.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.