CriticalVulnerabilityNov 9, 2026

SAP NetWeaver webshell campaign exploits CVE-2025-31324

Attackers are actively scanning for and exploiting SAP NetWeaver vulnerability CVE-2025-31324 to upload webshells. The flaw allows unauthenticated file uploads with a CVSS score of 10. Webshells typically end up in /irj/servlet_jsp/irj/root/ directories. Organizations running SAP NetWeaver should patch immediately and audit for webshells.

Vulnerabilities

CVE-2025-31324 CVSS 9.8 EPSS 99% Exploited (CISA KEV)

Source

SANS ISCRead the original article

AI-written summary. Check the original reporting before acting.