CVE-2025-31324
What is it?
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Official description from NVD.
What happened
Attackers are actively scanning for and exploiting SAP NetWeaver vulnerability CVE-2025-31324 to upload webshells. The flaw allows unauthenticated file uploads with a CVSS score of 10. Webshells typically end up in /irj/servlet_jsp/irj/root/ directories. Organizations running SAP NetWeaver should patch immediately and audit for webshells.
From the Intel60 brief of Nov 9, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalSAP NetWeaver webshell campaign exploits CVE-2025-31324Nov 9, 2026