[HIGH PRIORITY] SAP NetWeaver Visual Composer RCE (CVE-2025-31324)

⚠ HIGH PRIORITY — CISA KEV. CVE-2025-31324 is an unauthenticated remote code execution flaw in SAP NetWeaver Visual Composer / Metadata Uploader on Java-based SAP stacks. Attackers deploy JSP webshells and pivot to SAP ERP databases on Linux hosts.

Affected SAP products

• SAP NetWeaver Java Visual Composer before fixed SAP Security Note
• Metadata Uploader component on exposed SAP Java ports (50000/50100)
• Self-hosted SAP on SUSE/RHEL with Tomcat backend

Detect exposure

nmap -p 50000,50100,443 sap-subnet/24
curl -sk https://sap.example:443/irj/portal | head -5

Patching Method

1. Download SAP Security Note patch from SAP Support Portal (S-user required).
2. Schedule SAP maintenance window — stop SAP Java stack via SAP MMC or sapcontrol -nr 00 -function Stop.
3. Apply SAP kernel/SCA component updates per note instructions.
4. Restart SAP instances; verify component version in SAP GUI or sapcontrol -nr 00 -function GetVersionInfo.
5. Scan /usr/sap/*/J* for unexpected JSP/webshell files.
6. Rotate SAP admin, DB, and RFC credentials after patch.

# Linux SAP host — check for webshells
find /usr/sap -name '*.jsp' -mtime -14 -ls 2>/dev/null
grep -R 'Visual Composer' /usr/sap/*/J*/ 2>/dev/null | head

Until patched

• Disable Metadata Uploader if SAP note provides workaround
• Block SAP Java ports from internet at firewall
• Require VPN for all SAP admin access