On Thursday of last week, Rimini Protect™ security services identified that a critical vulnerability in SAP NetWeaver was actively exploited by threat actors. This exploit enables attackers to compromise systems without requiring authentication and then allows for lateral movement to carry out other malicious activities, such as data exfiltration and ransomware attacks. The CVSS score for this vulnerability is the highest possible, rated at 10 out of 10[1] and exploit behavior has been extensive.
Due to the seriousness of this vulnerability and its wide-ranging impact on SAP users, we are publicly sharing a summarized version of our Zero-Day Report, which is normally restricted to our clients. This report includes general mitigation options and guidance to help identify and address this threat. We are making this this zero-day report available with no subscriptions required, no requirement to be a Rimini Street client, and no hidden conditions. Please feel free to download our report now.
For Rimini ProtectTM Application Risk Mitigation (ARM) subscribers, no action is required from you to protect against the exploitation of this vulnerability. For all Rimini ONETM clients [those receiving both L4 software support and managed services from Rimini Street], corrective changes have been proactively applied to your environment. No action is required from you to protect against the exploitation of this vulnerability.
Overview of activity:
- April 24, 2025: Rimini Protect™ security services found that an Unrestricted File Upload vulnerability in SAP NetWeaver was being actively exploited in the wild.
- April 24, 2025: NIST National Vulnerability Database published CVE-2025-31324 describing this vulnerability.[2]
- April 25, 2025: The Rimini Protect team notified our clients of the discovered vulnerability and mitigation options.
- April 29, 2025: US government agency CISA (Cybersecurity and Infrastructure Security Agency) added this vulnerability to the Known Exploited Vulnerabilities (KEV) list,[3] publicly indicating active exploitation in the wild.
Rimini Protect clients were provided mitigation options four days before the CISA notification was sent to the public.
How it’s impacting SAP customers:
- The authorization mechanism of the Metadata Uploader in SAP NetWeaver Visual Composer fails to properly validate that users have the appropriate permissions before allowing file uploads.
- Unauthenticated attackers can upload executable files into public folders and compromise the system. From there the attackers can move laterally within the target’s environment and can deploy attacks including ransomware.
Download the Rimini Protect™ Zero Day Report to share with your IT and Security team and take action now.
For more information on Rimini Street’s proactive, fast, and cost-effective security solutions tailored specifically for enterprise software environments, click here now.
Content contributed by Kevin Eyre, Sr. Director Product Marketing, Rimini Street
[1] CVE.org: CVE-2025-31324
[2] NIST National Vulnerability Database: CVE-2025-31324 Detail
[3] CISA Adds One Known Exploited Vulnerability to Catalog
