Zero-Day: CVE-2025-31324

Yes, it is very likely that version of NetWeaver Java is vulnerable. Additionally that version of NetWeaver Java is no longer supported by SAP and as a result SAP will not issue security patches to address this vulnerability on that version. Our recommendation is to follow one of the workaround steps described in SAP Note and have a plan to upgrade that system to a version of NetWeaver Java that is supported by SAP.

The only thing that will change if the SAP Application is not internet-facing is the frequency of exploitation. The vulnerability should still be considered critical and should be acted on immediately. Due to the nature of the vulnerability and how it is exploited, we expect to see automated exploit tools taking advantage of this vulnerability or tools that could easily be executed from within a network. Additionally, this could be leveraged by malicious software such as malware or ransomware.

We are gathering consolidated information related to the targeted industries, but at this stage all critical infrastructure should be considered at high risk based on the level of threat activity Onapsis Research Labs have seen. Having said that, all organizations are at high risk, due to the nature of this vulnerability, the exploitation over HTTP, and the level of threat activity seen over the past couple of days.

In general, Windows-based OSs are a preferred target for Ransomware gangs, because they have everything instrumented when it comes to ransomware, but it is not limited to just windows. I would not assume that if your SAP systems are running on a non-windows OS you are immune from a ransomware attack.

You need to list the Components of the SAP System. If “VISUAL COMPOSER FRAMEWORK”, or VCFRAMEWORK is installed, then the system is vulnerable, unless you apply the patch from SAP Security Note: #3594142 or the mitigations in SAP KB #3593336 (which are basically to make the component unreachable)

If you are an Onapsis customer, you can use Assess to scan all your JAVA systems. Assess will identify not only the systems that have the component, but report an issue for any that have the component and are not secured against the vulnerability.

It depends on whether the vulnerable component was included in the installation of that Solution Manager system. You will have to list the JAVA components of your Java SID, looking for the “VISUAL COMPOSER FRAMEWORK”, or VCFRAMEWORK component.

The vulnerability was not reported by any security researcher. It is unknown who found it, but it was being widely exploited across SAP applications. It is important to stress that this is not the result of theoretical research in a lab, there is active and ongoing exploitation of this vulnerability in the wild.