Security readout for executives and security teams
Plain-English summary
A missing authorization check in SAP NetWeaver Visual Composer can let an unauthenticated attacker upload executable files. Successful abuse could give attackers broad control over the host, exposing sensitive information, altering systems, or disrupting operations. CISA lists the vulnerability as known exploited.
Executive priority
Treat this as an immediate incident-response and remediation priority. Confirm exposure, apply SAP's prescribed remediation, and investigate affected systems for compromise rather than assuming patching alone removes prior access. Give externally reachable systems precedence and track completion through executive risk governance.
Technical view
CVE-2025-31324 affects the Visual Composer Metadata Uploader in the reported VCFRAMEWORK 7.50 configuration. The network-accessible uploader lacks proper authorization and accepts potentially malicious executable binaries without credentials or user interaction. It is classified as CWE-434 and carries CVSS 3.1 score 10.0.
Likely exposure
Exposure is limited to environments running the affected SAP NetWeaver Visual Composer development-server component and configuration. The record identifies VCFRAMEWORK 7.50 while marking other configurations unaffected by default. Systems reachable from untrusted networks warrant the fastest assessment, but the supplied evidence does not define every deployment prerequisite.
Exploitation context
Active exploitation is supported by CISA's Known Exploited Vulnerabilities catalog and the cited Onapsis analysis. The flaw requires neither authentication nor user interaction and may affect confidentiality, integrity, and availability. The supplied evidence does not quantify victim numbers or identify every threat actor.
Researcher notes
The core issue combines missing authorization with unrestricted upload of executable content. CVSS reports network access, low complexity, no privileges, no interaction, changed scope, and high impact across all three security objectives. Exact endpoint details, forensic indicators, remediation mechanics, and affected deployment prerequisites are not provided in the supplied bundle.
Mitigation direction
- Review SAP Security Note 3594142 and current SAP Security Patch Day guidance immediately.
- Apply the vendor-prescribed remediation to every confirmed affected system.
- Prioritize affected systems reachable from the internet or other untrusted networks.
- Use SAP guidance for temporary protections if remediation cannot be completed immediately.
Validation and detection
- Inventory SAP systems for Visual Composer development server and VCFRAMEWORK 7.50.
- Confirm applicability and remediation status using SAP Security Note 3594142.
- Identify whether affected uploader functionality is reachable from untrusted networks.
- Review affected hosts for unexpected uploaded executables or other evidence of compromise.
- After remediation, verify the authorization control using vendor-approved checks.
Public sources used
The source record changed after analysis: Material source record changed after analysis.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-31324 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96sapVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-31324 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-04-29T00:00:00.000Z: CVE-2025-31324 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://me.sap.com/notes/3594142CVE reference, sap
- https://url.sap/sapsecuritypatchdayCVE reference, sap
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/CVE reference, CISA-ADP · technical-description
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31324CVE reference, CISA-ADP · government-resource
- https://www.theregister.com/2025/04/25/sap_netweaver_patch/CVE reference, CVE
- https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.