CVE-2025-31324

This vulnerability in SAP NetWeaver's Visual Composer metadata uploader (CVE-2025-31324, CVSS 9.8) is misnamed in the disclosure. The 'metadata' framing obscures what the component actually does: accepts binary uploads without any authentication. That capability should never exist with zero auth, regardless of network segmentation assumptions. The 9.8 severity and 0.995 EPSS score tell you exploitation was trivial and immediate—no memory corruption, no chaining required. That points to attackers with pre-existing knowledge of the endpoint, likely commodity toolkit operators running mass scans within hours of disclosure. The critical question for your environment is execution context. The metadata uploader runs under NetWeaver's Java application service account, which means host-level compromise gives you direct access to the configuration layer, system landscape, and credential stores for connected S/4HANA, SuccessFactors, or Ariba instances. This isn't just host compromise—it's potential pivot into the entire enterprise resource planning stack. There's a second layer to this that the CVE description doesn't capture: Visual Composer is deprecated. This component survived not through active neglect but through organizational amnesia—the deprecation notice removed attention without removing the capability. That pattern matches CVE history across BEA WebLogic, Oracle Fusion, and IBM WebSphere, where deprecated administrative endpoints with soft names persist and get rediscovered years later. For your response: assume compromise as a working hypothesis, not a worst case. Check whether Visual Composer is still active in your NetWeaver environment and determine if access logs for the uploader were pruned as part of sunset maintenance—if so, you face both a critical vulnerability and a forensic blind spot. Beyond patching, treat every deprecated component in your NetWeaver stack as an active exposure candidate, not a resolved modernization task. The metadata uploader wasn't supposed to matter anymore—and that's precisely why it does.

Reviewed through automated stages and approved by a human before publication.