Vulnerabilities

CVSS

10.0 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2025-04-24

Status

Published

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted system.

Weaknesses

CWE-434

Coverage 1

vulnerability

SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch

A critical security vulnerability (CVE-2026-58231) in SAP Commerce Cloud is being actively exploited, despite a patch being available for days. The flaw stems from inadequate input validation, potentially leading to code…

The Hacker News · Aug 15, 2026 Critical

CVE-2026-58231CVE-2025-31324USsapvulnerabilitypatch

All articles mentioning it

Advisories and references

• me.sap.com/notes/3594142
• url.sap/sapsecuritypatchday
• onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-3...
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...
• theregister.com/2025/04/25/sap_netweaver_patch/
• bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zer...