CVE-2025-31324
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2025-31324. We'll provide specific mitigation strategies based on your environment and risk profile.
CVSS Score
V3.1EPSS Score
v2025.03.14There is a 63.5% chance that this vulnerability will be exploited in the wild within the next 30 days.
Attack Vector Metrics
Impact Metrics
Description
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.
Available Exploits
Related News
A working exploit concatenating two critical SAP Netweaver vulnerabilities (CVE-2025-31324, CVE-2025-42999) that have been previously exploited in the wild has been made public by VX Underground, Onapsis security researchers have warned. The exploit has alleg…
Exploit chaining CVE-2025-31324 & CVE-2025-42999 in SAP NetWeaver enables auth bypass and RCE, risking compromise and data theft. A new exploit chaining two vulnerabilities, tracked as CVE-2025-31324 and CVE-2025-42999, in SAP NetWeaver exposes organizations …
A new exploit combining two critical, now-patched security flaws in SAP NetWeaver has emerged in the wild, putting organizations at risk of system compromise and data theft. The exploit in question chains together CVE-2025-31324 and CVE-2025-42999 to bypass a…
Hackers exploited a SAP NetWeaver bug to deploy upgraded Auto-Color Linux malware in an attack on U.S. chemicals firm. Cybersecurity firm Darktrace reported that threat actors exploited a SAP NetWeaver flaw, tracked as CVE-2025-31324, to deploy Auto-Color Lin…
Hackers were spotted exploiting a critical SAP NetWeaver vulnerability tracked as CVE-2025-31324 to deploy the Auto-Color Linux malware in a cyberattack on a U.S.-based chemicals company. [...]
Affected Products
Affected Versions:
Known Exploited Vulnerability
This vulnerability is actively being exploited in the wild
Remediation Status
Due Date
Added to KEV
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Product
Ransomware Risk
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Advisory Details
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Advisory provided by GitHub Security Advisory Database. Published: April 24, 2025, Modified: May 2, 2025
Social Media Intelligence
Real-time discussions and threat intelligence from social platforms
🛡️ CyberDudeBivash — Daily Global CVE Vulnerability Report Brand/Author: CyberDudeBivash • Site: www.cyberdudebivash.com • Edition: 2025-08-19 # 1) Executive snapshot * **Actively exploited today (CISA KEV add):** Trend Micro **Apex One** command injection **CVE-2025-54948** → **patch priority 1**. [CISA](https://www.blogger.com/blog/post/edit/2163240462341298251/6141938943822698347#) * **Public exploit/noise today:** SAP NetWeaver (AS Java Visual Composer) **CVE-2025-31324** …
Public Exploit for Chained SAP Flaws Exposes Unpatched Systems to Remote Code Execution A new exploit combining two critical, now-patched security flaws in SAP NetWeaver has emerged in the wild, putting organizations at risk of system compromise and data theft. The exploit in question chains together CVE-2025-31324 and... **CVEs:** CVE-2025-31324,CVE-2025-42999 …
Looking for community input on CVE-2025-31324 in SAP NetWeaver Hi all, I’ve been reviewing the recently published CVE-2025-31324 related to SAP NetWeaver Java and wanted to ask how others are approaching it in their environments. SAP has provided guidance and notes for remediation, and I’m interested in hearing how teams …
🔥 Top 10 Trending CVEs (18/08/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-8091](https://nvd.nist.gov/vuln/detail/CVE-2025-8091)** - 📝 The EventON Lite plugin for WordPress is vulnerable to Information Exposure in all versions less than, or equal to, 2.4.6 via the add_single_eventon and add_eventon shortcodes due to …
🔥 Top 10 Trending CVEs (17/08/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-26633](https://nvd.nist.gov/vuln/detail/CVE-2025-26633)** - 📝 Microsoft Management Console Security Feature Bypass Vulnerability - 📅 **Published:** 11/03/2025 - 📈 **CVSS:** 7 - 🧭 **Vector:** CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C - 📣 **Mentions:** 61 - ⚠️ **Priority:** 2 - …
🔥 Top 10 Trending CVEs (01/08/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-53558](https://nvd.nist.gov/vuln/detail/CVE-2025-53558)** - 📝 n/a - 📈 **CVSS:** 0 - 🧭 **Vector:** n/a - ⚠️ **Priority:** n/a - 📝 **Analysis:** No Information available for this CVE at the moment --- **2. [CVE-2025-54576](https://nvd.nist.gov/vuln/detail/CVE-2025-54576)** …
Hackers Use SAP Flaw to Breach Linux Systems with Auto-Color Malware **A critical SAP vulnerability is being exploited to deploy the Auto-Color malware in targeted attacks.** **Key Points:** - SAP NetWeaver flaw CVE-2025-31324 allows remote code execution. - Attackers targeted a U.S.-based chemicals company and the incident lasted three days. …
Auto-Color Backdoor Targets U.S. Chemical Firm via CVE-2025-31324
Hackers Target SAP NetWeaver Vulnerability to Deploy Stealthy Linux Malware **A critical SAP NetWeaver flaw is being exploited by hackers to deliver a sophisticated Linux malware called Auto-Color.** **Key Points:** - CVE-2025-31324 allows unauthorized attackers to execute malicious code remotely. - Auto-Color malware features advanced evasion tactics making detection challenging. …
🧵 Auto-Color Malware Hits U.S. Chemical Firm via SAP NetWeaver Exploit Auto-Color RAT is back, this time leveraging CVE-2025-31324 to target critical U.S. infrastructure. Disguised via ld.so.preload, it delays execution and encrypts C2 traffic. Darktrace confirms its first known use in the NetWeaver breach. Expert guidance from Qualys & Sectigo …