Critical SAP NetWeaver Zero-Day Vulnerability: What Your Houston Business Needs to Know

A missing authorization check on a single endpoint turns file upload into full server takeover.

CVE-2025-31324 is an unauthenticated file upload flaw in the Metadata Uploader of SAP NetWeaver Visual Composer. A missing authorization check lets an attacker send a crafted POST request to the /developmentserver/metadatauploader endpoint and upload an executable file with no login required. It carries a CVSS score of 10.0, the maximum.

The reason a file upload rates a perfect 10 is what the file can do once it lands. An attacker uploads a JSP or WAR file, which the SAP Java stack then runs, giving remote code execution as the SAP service account. From there the report chain is grim: full system compromise, access to whatever business data the SAP system holds, and a foothold to move deeper into the network. There is no privilege to steal and no password to guess. The check that should have said "you are not allowed to do that" was simply absent.

• A second flaw makes it worse. SAP patched a related bug, CVE-2025-42999, on May 13, 2025 - a deserialization vulnerability in the same Visual Composer component, rated CVSS 9.1. Attackers chain the two to run code even on systems that had partly hardened the upload endpoint.
• Visual Composer is not on by default, but it is on a lot. Onapsis and others estimate 50 to 70 percent of internet-facing SAP NetWeaver Java systems have the component enabled, usually left over from old no-code development work nobody uses anymore.
• It is confirmed exploited, not theoretical. CISA added CVE-2025-31324 to its Known Exploited Vulnerabilities catalog on April 29, 2025, and CVE-2025-42999 on May 15, 2025 - the government's signal that these are being used against real targets right now.

The pattern is web shell first, then hands-on-keyboard access sold or handed off.

Attackers hit the /developmentserver/metadatauploader endpoint, drop a JSP web shell into the SAP servlet path, and use it to run commands, pull down more tools, and reach out to command-and-control servers. Rapid7 found web shells planted in the SAP application directory across multiple victim environments.

In several cases the intruders went further than a basic web shell. Researchers at ReliaQuest and others documented the post-exploitation framework Brute Ratel C4 being deployed, along with a technique called Heaven's Gate used to slip past endpoint protection. That is not smash-and-grab work. Security firms assess the activity is consistent with initial access brokers - specialists who break in, establish durable access, and then sell that access to ransomware crews and other buyers. So the first breach may be quiet on purpose. The damage shows up later, when the access changes hands.

The uncomfortable part for a smaller business is that you may never be the intended final target. An initial access broker does not care whether you are a 40-person engineering firm or a Fortune 500. An internet-facing SAP box with Visual Composer enabled is inventory. If it is exposed and unpatched, it gets scanned, and public exploit code for this chain has been circulating since August 2025, which lowered the skill bar for the next wave of opportunistic attackers.

Patch, or disable the vulnerable component, then hunt for signs you were already hit.

SAP released an out-of-band emergency patch for CVE-2025-31324 as Security Note 3594142, followed by the fix for CVE-2025-42999 in May 2025. Applying both notes is the primary fix. If you cannot patch immediately, restrict or block access to the /developmentserver/metadatauploader endpoint and disable Visual Composer if you do not use it.

Because exploitation predates the public disclosure, patching alone is not enough - you have to assume a window where you may have been exposed and check for it. Walk this in order:

• Apply SAP Security Notes 3594142 and 3604119. Install the fixes for CVE-2025-31324 and CVE-2025-42999. This is the step that actually closes the hole; everything else buys time.
• Lock down or disable the endpoint. If a patch window is days out, restrict access to /developmentserver/metadatauploader at the web tier, and turn Visual Composer off entirely if nobody is using it.
• Hunt for web shells. Scan the SAP servlet directories for unexpected JSP files and unfamiliar executables. A dropped web shell is the clearest sign of compromise here.
• Pull SAP and network logs into your SIEM. Look for suspicious POST requests to the upload endpoint, odd outbound connections, and process activity that does not match normal SAP behavior.
• Assume nothing if you find something. A confirmed web shell means engage incident response, not a quiet delete. Attackers who got in early may have already established a second way back.

One point that gets lost in the rush to patch: this flaw is a reason to know what is actually exposed to the internet in your environment. A lot of Houston businesses do not have a current inventory of which SAP components are enabled or which servers face outward. You cannot patch a system you forgot you had.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area, with vulnerability management and fast patching built into how we run every client environment.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. A zero-day like CVE-2025-31324 is exactly the scenario a managed partner exists to absorb - the alert comes in, someone whose job it is reads it, and your systems are checked and patched before the story hits the trade press:

• Know what you have. We maintain an inventory of your systems and what is exposed to the internet, so a flaw in a component you forgot was running does not become a surprise breach.
• Patch on a clock, not a hope. Critical patches get tracked, tested, and applied against a timeline, which is the single control the SAP NetWeaver report keeps coming back to.
• Watch for the aftermath. Log monitoring and endpoint detection catch the web shell, the odd outbound connection, and the follow-on activity that patching alone would miss.
• Respond when it counts. If a scan turns up a sign of compromise, we move to containment and investigation instead of hoping it was nothing.

SAP flaws hit hardest in the industries that define Houston's economy, so this matters most for local manufacturing, energy and utilities, and oil and gas firms. If you run SAP, or a vendor in your supply chain does, and you could not say today whether CVE-2025-31324 is patched in your environment, that uncertainty is the risk. Businesses in Houston and Katy can talk to CinchOps and get a straight answer.