Vulnerabilities · 3 days ago

SAP NetWeaver flaw fuels webshell planting and searches

SANS ISC saw attackers exploiting SAP NetWeaver’s CVSS 10.0 CVE-2025-31324 to upload webshells and search for ones already present. The activity appeared in SANS’s honeypot data.

The flaw lets attackers upload executable files without logging in. A webshell is a file they can later reach through the web server to run commands. Because the activity also probes for shell files, it may find footholds planted in earlier compromises—not just create new ones.

For an internet-reachable NetWeaver server exposed while the flaw was open, a patched version does not establish whether a webshell remains. The vulnerability status and the host’s compromise history are separate questions.

CVE-2025-31324

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: sAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing… Known ransomware campaign use. EPSS 99% (100th percentile).

CISA federal remediation date May 20 · date passed

Timeline

Nov 9 Reported by SANS ISC
May 20 CISA federal deadline for CVE-2025-31324 passed
Apr 29 CVE-2025-31324 added to CISA KEV

Sources

1 source covering this story

SANS ISC Nov 9
Attackers Searching for SAP Netweaver Webshells - SANS ISC
Attackers Searching for SAP Netweaver Webshells, Author: Johannes Ullrich

Entities

CVE-2025-31324

Part of the PlainSec briefing for 2026-11-10

Editions

Vulnerabilities · 3 days agoSAP NetWeaver flaw fuels webshell planting and searchesSANS ISC saw attackers exploiting SAP NetWeaver’s CVSS 10.0 CVE-2025-31324 to upload webshells and search for ones already present. The activity appeared in SANS’s honeypot data.The flaw lets attackers upload executable files without logging in. A webshell is a file they can later reach through the web server to run commands. Because the activity also probes for shell files, it may find footholds planted in earlier compromises—not just create new ones.For an internet-reachable NetWeaver server exposed while the flaw was open, a patched version does not establish whether a webshell remains. The vulnerability status and the host’s compromise history are separate questions.

CVE-2025-31324

NVD KEV

Known exploited · CISA KEV

CVSS 10 CRITICAL: sAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing… Known ransomware campaign use. EPSS 99% (100th percentile).