SANS observes attackers targeting SAP NetWeaver webshells

On 9 November 2026, Johannes Ullrich of the SANS Internet Storm Center reported a campaign targeting SAP NetWeaver installations or already deployed webshells. The activity was observed in honeypot data, with a notable request path /irj/servlet_jsp/irj/root/ant.jsp linked to the effort. The exploitation hinges on CVE-2025-31324, a vulnerability described by Ullrich as having a CVSS score of 10 and enabling unauthenticated file uploads. The exploit allows attackers to upload webshells, which Ullrich notes commonly land in the /irj/servlet_jsp/irj/root/ directory.

The report identifies a specific attacker IP, 82.26.72[.]21, and lists a wide range of target URLs that have been probed or accessed in the campaign. Examples include /_layouts/15/start.aspx, /api/upload, /authenticationendpoint/ant.jsp, /commandcenter/deployWebpackage[.]do, /m/webadmin/upload, /images/ant.php, and several other paths referencing common webshell and uploader patterns such as ant.jsp, ant.php, and upload.aspx.

Ullrich emphasises that not all requests are strictly SAP NetWeaver related, and highlights an unusual misspelling of “upload.aspx” in several entries. The report relies on observed artefacts in the honeypot environment and attributes the findings to the researcher and the SANS ISC. No additional guidance or remediation is provided in the article beyond describing the observed exploitation activity and the implicated CVE.