SAP fixes suspected NetWeaver zero-day exploited in attacks

SAP has released out-of-band emergency NetWeaver updates to fix a suspected remote code execution (RCE) zero-day flaw actively exploited to hijack servers. The vulnerability, tracked under CVE-2025-31324 and rated critical (CVSS v3 score: 10.0), is an unauthenticated file upload vulnerability in SAP NetWeaver Visual Composer, specifically the Metadata Uploader component. It allows attackers to upload malicious executable files without logging in, potentially leading to remote code execution and full system compromise. Though the vendor's bulletin isn't public, ReliaQuest reported earlier this week about an actively exploited vulnerability on SAP NetWeaver Visual Composer, specifically the '/developmentserver/metadatauploader' endpoint, which aligns with CVE-2025-31324. ReliaQuest reported that multiple customers were compromised via unauthorized file uploads on SAP NetWeaver, with the attackers uploading JSP webshells to publicly accessible directories. These uploads enabled remote code execution via simple GET requests to the JSP files, allowing command execution from the browser, file management actions (upload/download), and more. In the post-exploitation phase, the attackers deployed the 'Brute Ratel' red team tool, the 'Heaven's Gate' security bypassing technique, and injected MSBuild-compiled code into dllhost.exe for stealth. ReliaQuest noted in the report that exploitation did not require authentication and that the compromised systems were fully patched, indicating ...