ReliaQuest Uncovers New Critical Vulnerability in SAP NetWeaver

ReliaQuest describes active exploitation of a critical SAP NetWeaver Visual Composer vulnerability (CVE-2025-31324) allowing unauthenticated JSP webshell uploads and remote command execution; attackers have deployed webshells to specific NetWeaver directories and used post-exploitation tooling such as Brute Ratel, PipeMagic, and Heaven’s Gate, with evidence of chaining to a deserialization bug (CVE-2025-42999) and involvement by ransomware groups (BianLian, RansomEXX). The report provides detailed TTPs, IOCs (hashes, IPs, domain, file paths), mitigation guidance (patching, disabling Visual Composer, log forwarding), and recommends immediate patching and monitoring.