Attackers are actively searching for SAP NetWeaver webshells, exploiting a vulnerability that has been around since 2025. The campaign is widespread, with one particular attacker scanning networks for potential targets. SAP customers and organizations using NetWeaver should be on high alert, as the attackers’ goal is to gain unauthorized access to sensitive systems.
The exploited vulnerability, CVE-2025-31324, is a serious issue that allows attackers to upload files without authentication, earning it a perfect 10 out of 10 CVSS score. This vulnerability has been known for over a year, and its simplicity makes it an attractive target for cybercriminals. Attackers have been using it to deploy webshells, which are malicious scripts designed to provide remote access to compromised systems.
The attackers’ tactics are not limited to SAP NetWeaver-specific URLs, but rather focus on finding any entry point into the system. The URL path provided by SANS ISC’s Johannes Ullrich reveals a pattern of attacks aimed at exploiting vulnerabilities in various components, including file upload pages and administrative interfaces. This indicates that the attackers are using a reconnaissance phase to identify potential targets before launching a more targeted attack.
The use of webshells is a common tactic employed by attackers to maintain persistence on compromised systems. Once deployed, these scripts can provide a backdoor for further attacks or data exfiltration. SAP customers should prioritize patching and updating their NetWeaver systems to prevent exploitation of this vulnerability. Additionally, regular monitoring of system logs and network activity will help identify any potential indicators of compromise.
As the cybersecurity landscape continues to evolve, it’s essential for organizations to stay vigilant against emerging threats. The widespread nature of this campaign highlights the importance of proactive security measures, such as vulnerability management and incident response planning. By staying informed and taking steps to secure their systems, SAP customers can reduce the risk of falling victim to these types of attacks.
In light of this threat, we recommend that SAP customers take immediate action by:
* Reviewing their system configurations for any vulnerabilities related to file upload pages
* Applying patches for CVE-2025-31324 as soon as possible
* Conducting regular security audits and penetration testing to identify potential entry points
* Implementing robust incident response planning and monitoring to quickly detect and respond to potential attacks
Source: SANS ISC — 2026-11-09