Vulnerability intelligence
CVE-2025-31324
SAP NetWeaver Unrestricted File Upload Vulnerability
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
CVSS Score
10
Critical
EPSS — Exploit Probability
99%
Riskier than 100% of all CVEs · checked 2026-10-18
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
Unconfirmed
Federal deadline 2025-05-20
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2025-05-20.
1 article across 1 outlet · first covered Mar 23, 2026 · latest Mar 23, 2026
Coverage timeline
-
M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Secondswww.securityweek.com · Mar 23, 2026