CVE-2025-31324

Deeper analysis

SAP NetWeaver Visual Composer Metadata Uploader contains an authorization bypass vulnerability (CWE-434) that permits unauthenticated file uploads of arbitrary executable binaries. The flaw affects the SAP NetWeaver component and carries a CVSS 3.1 base score of 10.0, reflecting network-accessible attack vector, low complexity, no required privileges or user interaction, and complete loss of confidentiality, integrity, and availability with scope change to other system components.

Unauthenticated remote attackers can exploit the issue to upload and execute malicious binaries on the host, enabling full system compromise. Successful attacks can therefore result in arbitrary code execution with severe impact on the targeted SAP environment and any connected systems.

SAP has published remediation guidance in security note 3594142 and the April 2025 patch day release. Multiple independent reports confirm that the vulnerability was under active exploitation in the wild shortly after disclosure, including suspected zero-day usage prior to the availability of patches.

The associated EPSS score has risen sharply from a low baseline to a current value of 0.4366 with a recorded peak of 0.4871, indicating that exploitation interest increased materially after public disclosure.