SAP’s 10/10 Bug: A Perfect Storm of Zero-Day Exploits and Paywall Mysteries!
SAP’s latest patch tackles a 10/10 bug in NetWeaver that might have already been exploited as a zero-day. But SAP keeps the juicy details locked behind a paywall. Meanwhile, experts urge patching pronto to thwart potential ransomware attacks. Vulnerability CVE-2025-31324 could be a hacker’s dream come true.
Hot Take:
**_Oh SAP, you’ve done it again! Dropping a spicy zero-day vulnerability bombshell on us with a perfect 10/10 score. Yet, instead of letting us peek behind the curtain, you’ve slapped on a paywall. It’s like being invited to a magic show and then being handed an invoice before the rabbit is pulled from the hat!_**
Key Points:
– SAP releases an out-of-band patch for a critical 10/10 vulnerability in NetWeaver.
– The flaw is in the metadata uploader of the NetWeaver Visual Composer app-building tool.
– Security experts suspect the vulnerability has already been exploited as a zero-day.
– Onapsis confirms potential for full control over SAP systems, risk of ransomware, and lateral network movement.
– ReliaQuest suggests similar vulnerabilities have been exploited using webshells and advanced techniques.