Exploited vulnerabilitiesBriefPublic record
SAP NetWeaver Visual Composer unrestricted upload (CVE-2025-31324)
Disclosed 24 Apr 2025. CVSS 10. Exploited as a zero-day.
- Disclosed
What happened
- Disclosed 24 Apr 2025. CVSS 10. Exploited as a zero-day. Followed by CVE-2025-42999.
- KEV: 29 Apr 2025. Hundreds of webshells reported (Onapsis, ReliaQuest). Exploited by China-nexus actors and ransomware groups.
Live scores
Live scores
CVE-2025-31324- EPSS
- 0.995
very likely to be attacked soon - VEDAS
- 0.982
strong exploit evidence - On CISA KEV
- Yes, since 2025-04-29
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2025-42999- EPSS
- 0.129
likely to be attacked soon - VEDAS
- 0.762
some exploit evidence - On CISA KEV
- Yes, since 2025-05-15
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
- https://nvd.nist.gov/vuln/detail/CVE-2025-31324
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.