Threat Actors Hacking SAP Critical Flaw

Threat actors are exploiting a zero-day flaw in a partially deprecated SAP tool still widely used by governments and businesses.

See Also: Live Webinar | Resilience in Crisis: Recovering Your Minimum Viable Company Fast

The vulnerability, tracked as CVE-2025-31324, affects SAP Visual Composer, a web-based software development tool used for transactional and analytical applications. The authentication flaw has a maximum vulnerability ranking of 10. Attackers can use it to upload webshells to take over the targeted system.

On Friday, SAP’s security division, Onapsis, disclosed that CVE-2025-31324 is “actively exploited in the wild.”

“No authentication is required to exploit it, allowing unauthenticated agents or unauthenticated threat actors to interact with the vulnerable component,” SAP said. The company deprecated some versions of Visual Composer in 2015, but extended maintenance for the 7.5 version of the tool until 2030.

The vulnerability specifically impacts the “development server” within the SAP Visual Composer component for SAP NetWeaver 7.xx that is “widely enabled” to assist its clients with “developing business components without the use of coding,” the company said.

The attackers could exploit the flaw through HTTP/HTTPS by sending POST requests to the /developmentserver/metadatauploader URL.

“Threat actors can upload potentially malicious code files, most commonly webshells. Examples of filenames observed include ‘helper.jsp’ and ‘cache.jsp,'” SAP said.

Internet tracking organization Shadow Server Foundation on Sunday said at least 454 IP addresses are vulnerable to the flaw, the majority of which are located in the U.S.

Security firm ReliaQuest observed the flaw after noticing multiple customer incidents, where hackers uploaded “JSP webshells” to execute malicious files.

“The goal of the webshell was clear: Use the JSP file to send GET requests that would execute arbitrary commands. This webshell gave attackers the tools to upload unauthorized files, seizing deeper control of compromised systems,” ReliaQuest said.

The attackers used pen testing tool Brute Ratel to load and decrypt malicious payload, which was used by hackers for privilege escalation, credential theft and persistence, the company said.

ReliaQuest believes hackers may have compromised SAP using credentials obtained from initial access brokers. “The alternative is an unreported RFI issue in SAP systems. This is possible because patches were applied that would have mitigated CVE-2017-9844,” the company added.

The company recommends disabling Visual Composer completely. It also recommends disabling developmentserver or restricting access to the server.