Exploit weaponizes SAP NetWeaver bugs for full system compromise

The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload request in a specific encoding format. The servlet will then decode this malicious request which will result in deserialization of data in the application leading to execution of arbitrary OS command on target as SAP Administrator. This vulnerability has High impact on confidentiality, integrity, and availability of the application.

CVE-2025-31324 is a critical (CVSS 9.8) unrestricted file upload flaw (CWE-434) in the Visual Composer Metadata Uploader component of SAP NetWeaver, which lacks proper authorization. An unauthenticated attacker can send crafted upload requests over the network to the Metadata Uploader endpoint and plant malicious executable binaries, such as webshells, on the host. Executing the uploaded files yields remote code execution with full impact on confidentiality, integrity, and availability, enabling system compromise, lateral movement, and ransomware deployment. Any organization running the affected SAP NetWeaver component is at risk, with the greatest exposure for instances reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2025-04-29, a public PoC exists, and researchers and media report active attacks, including by Chinese-linked actors deploying Golang-based implants on Linux systems and known ransomware use, often chained with CVE-2025-42999.

Do: Apply SAP's patch for CVE-2025-31324 (released in the April 2025 security updates) and follow the vendor mitigation instructions per CISA KEV/BOD 22-01 requirements. As interim mitigation, restrict or disable the Visual Composer Metadata Uploader endpoint and ensure it is not reachable from the internet; also patch the related CVE-2025-42999 since the flaws are being chained. Check affected hosts for uploaded webshells, Golang-based implants, and signs of ransomware activity.

A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers complete control over the affected system. This results in a severe impact on the confidentiality, integrity, and availability of the application and host environment.

SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability of the application.

SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

CVE-2025-42999 is an insecure deserialization flaw (CWE-502) in the Visual Composer Metadata Uploader component of SAP NetWeaver. It is triggered when a privileged user uploads untrusted or malicious content to the Metadata Uploader, which the application then deserializes; on its own the flaw requires high-privilege access, but attackers commonly chain it with the separately tracked unauthenticated upload flaw CVE-2025-31324 in the same component. Successful exploitation can yield remote code execution and full compromise of the host's confidentiality, integrity, and availability, with impact beyond the vulnerable component (CVSS scope changed, 9.1 critical). Any organization running SAP NetWeaver with the Visual Composer Metadata Uploader enabled, especially internet-facing application servers, is affected. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-05-15 with known ransomware use, and reporting links active attacks to ransomware groups (BianLian and RansomExx deploying the PipeMagic trojan) and to Chinese-linked APTs exploiting the sibling CVE-2025-31324.

Do: Apply SAP's security patches addressing CVE-2025-42999 together with the companion CVE-2025-31324 in the same Visual Composer Metadata Uploader, per vendor instructions, or restrict/disable access to the Metadata Uploader endpoint if patching is delayed. Given confirmed ransomware use (BianLian, RansomExx) and PipeMagic trojan deployments, review upload and authentication logs on NetWeaver servers and hunt for signs of compromise and post-exploitation activity. U.S. federal agencies must follow CISA BOD 22-01 guidance: apply mitigations by the KEV remediation due date or discontinue use of affected instances.