SAP has released emergency out-of-band updates to address a critical zero-day vulnerability in NetWeaver that is actively being exploited to compromise servers. The flaw, identified as CVE-2025-31324 with a maximum CVSS score of 10.0, affects the Visual Composer’s Metadata Uploader component.

## The Vulnerability

This unauthenticated file upload vulnerability allows attackers to upload malicious executable files without authentication, potentially leading to complete system compromise through remote code execution. The vulnerability specifically targets the ‘/developmentserver/metadatauploader’ endpoint.

## Observed Attacks

ReliaQuest reported that multiple customers have already been compromised through this vulnerability. Attackers have been:
– Uploading JSP webshells to publicly accessible directories
– Executing remote commands via simple GET requests
– Deploying sophisticated tools including ‘Brute Ratel’ and ‘Heaven’s Gate’
– Injecting malicious code into dllhost.exe for stealth operations

Security firm watchTowr confirmed active exploitation, with their CEO Benjamin Harris warning that “full Remote Code Execution and total system compromise” is possible, predicting “prolific exploitation by multiple parties” soon.

## Affected Systems

The vulnerability impacts Visual Composer Framework 7.50. Notably, systems updated with SAP’s regular April 2025 patch (released April 8) remain vulnerable, as this fix was released separately.

The emergency update also addresses two additional critical vulnerabilities:
– CVE-2025-27429: Code injection in SAP S/4HANA
– CVE-2025-31330: Code injection in SAP Landscape Transformation

## Mitigation Recommendations

Organizations unable to immediately apply patches should:
1. Restrict access to the /developmentserver/metadatauploader endpoint
2. Disable Visual Composer if not in use
3. Forward logs to SIEM solutions
4. Scan for unauthorized files in servlet paths
5. Perform deep environment scans to locate and remove suspicious files before implementing mitigations