Vulnerability intelligence
CVE-2025-31324
SAP NetWeaver Unrestricted File Upload Vulnerability
SAP NetWeaver
SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
CVSS Score
—
Unrated
EPSS — Exploit Probability
100%
Riskier than 100% of all CVEs · checked 2026-09-04
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
Unconfirmed
Federal deadline 2025-05-20
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2025-05-20.
1 article across 1 outlet · first covered Mar 23, 2026 · latest Mar 23, 2026
Coverage timeline
-
M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Secondswww.securityweek.com · Mar 23, 2026