SAP patches second zero-day flaw exploited in recent attacks

**SAP NetWeaver zero-day exploitation and patch advisory** — Multiple SAP NetWeaver vulnerabilities (notably CVE-2025-31324 and CVE-2025-42999) have been exploited in the wild to upload JSP web shells and tools like Brute Ratel; numerous exposed and compromised instances — including large enterprises — were observed, attribution links some activity to a Chinese actor (Chaya_004), and CISA added the issue to its Known Exploited Vulnerabilities catalog while SAP released patches and mitigation guidance.