SAP fixes suspected Netweaver zero-day exploited in attacks

SAP released an out-of-band emergency patch for a critical unauthenticated file-upload vulnerability (CVE-2025-31324, CVSS 10.0) in NetWeaver Visual Composer's Metadata Uploader that is being actively exploited in the wild to upload JSP webshells and achieve remote code execution; multiple security firms (ReliaQuest, Onapsis, watchTowr) reported customer compromises and observed post-exploitation tools and techniques. Organizations are advised to apply the emergency update immediately, restrict access to the /developmentserver/metadatauploader endpoint, disable Visual Composer if unused, forward logs to SIEM, and scan for unauthorized files.