SAP was the lane this site was known for, 2009 to 2012. Enterprise stack tradecraft; the components that sit in front of the business data and rarely get looked at hard. New team, new work, but the surface is still worth mapping; and in 2025 it produced the clearest example in years of how SAP actually gets broken. So: the modern SAP attack surface, read through the NetWeaver Visual Composer chain that ran through most of 2025.
The 2025 chain
2 CVEs, one component. CVE-2025-31324 is an unauthenticated file upload in the Metadata Uploader of NetWeaver Visual Composer (VCFRAMEWORK 7.50). CVSS 10.0. We walk the exploited request path end to end in a full reconstruction of the metadata-uploader chain. The endpoint is /developmentserver/metadatauploader; it was missing an authorization check, so an unauthenticated request could write arbitrary files to the Java application server filesystem. JSP, WAR, JAR, executables. Write a JSP webshell into the servlet root, request it, code runs with the privileges of the SAP Java process; typically <sid>adm. That is game over for the instance, reached with a single unauthenticated POST.
Exploitation in the wild ran ahead of the advisory. Rapid7 traced activity to at least 2025-03-27, mostly against manufacturing; SAP put the note out on 2025-04-24. Early payloads were plain webshells dropped into j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/, names like helper.jsp and cache.jsp. Nothing subtle; nothing that needed to be subtle, given the access.
The second CVE is where it gets interesting. CVE-2025-42999 is an insecure deserialization in the same Visual Composer component, CVSS 9.1, patched in SAP Security Note 3604119 on 2025-05-13. It chains with 31324. The Onapsis and later public analysis is clear on why the pair matters: with the deserialization primitive, the attacker no longer has to drop a file at all. A public exploit chaining the two surfaced in August 2025; it executes operating-system commands directly, as the SAP admin user, no webshell on disk. Living off the land, on an ERP box. The forensic surface shrinks to almost nothing; no artifact in the servlet root to find later.
The gap
This is the part worth sitting with, because it is the recurring shape and not a one-off. 31324 was the file upload; SAP shipped the authorization check for it in April. That closed the front door. It did not close the deserialization path underneath, which is why 42999 followed in May, and why the full remediation is 2 notes and not one; 3604119 plus the class-filtering hardening in 3660659. Patch the upload, the deserialization gadget is still reachable through other paths into the same component. Patch that, you still need strict class filtering or the next gadget works. Each patch closed the specific thing reported; the underlying capability, deserialize attacker bytes inside a pre-authentication component, took 3 steps to actually shut.
That is the gap. Not “SAP was slow”; SAP moved fast on all of it. The gap is between “a note shipped” and “the capability is gone”, and on a stack this large those are different dates, sometimes different quarters. The attacker only needs the capability to survive one of the steps.
Why Visual Composer is even reachable
Visual Composer is a legacy modelling component of the NetWeaver Java stack. Plenty of installs do not use it; plenty that do not use it still have it deployed and enabled, because turning SAP components off is a project and leaving them on is the default. The metadata uploader was reachable pre-authentication on instances that had no business exposing it. So the real attack surface in 2025 was not “SAP NetWeaver”; it was the subset of NetWeaver Java systems with Visual Composer enabled and the HTTP port reachable from somewhere an attacker sits. That subset was large enough to make CISA KEV and a manufacturing-sector exploitation wave.
Same shape, older components
Anyone who followed SAP security before 2025 will recognise the pattern, because the flagship SAP bugs of the last 5 years are the same shape with different components:
- RECON, CVE-2020-6287 (2020). NetWeaver AS Java, LM Configuration Wizard. Missing authentication; an unauthenticated attacker creates an administrative user over HTTP. CVSS 10.0. Pre-auth component doing privileged things, reachable.
- ICMAD, CVE-2022-22536 (2022). Internet Communication Manager, the HTTP front end for most SAP products. A memory-pipe desynchronisation; request smuggling at the ICM layer. CVSS 10.0. Prepend bytes to another user’s request, poison caches, impersonate. HTTP desync, in an ERP front end.
3 components, 5 years: LM Configuration Wizard, the ICM, Visual Composer. Each a pre-authentication surface that most operators did not know was reachable, each rated at or near maximum, each exploited in the wild. The SAP attack surface is not a list of memory bugs; it is a set of privileged pre-auth components bolted onto a stack that assumes it lives on a trusted network, exposed on systems that no longer do.
What this means for 2026
Enterprise-application exploitation is its own discipline; it does not look like browser or kernel work, and the mitigations that matter are not the ones that matter there. No CET, no CFG helps you when the bug is a missing authorization check on an HTTP endpoint that runs code as <sid>adm. The controls that move the needle are boring and organisational: know which NetWeaver Java instances have Visual Composer enabled, know which SAP HTTP ports are reachable and from where, and treat “the note shipped” as the start of the exposure window, not the end of it.
The Visual Composer chain will keep producing incidents into 2026 for the same reason RECON did in 2021 and ICMAD did in 2023: the patch existed long before the patch was applied everywhere, and the component was reachable long before anyone audited whether it needed to be. The exploit chain was public by August; the unpatched, internet-facing, VC-enabled instances did not all disappear in August. They rarely do.
Components change; the shape holds. Pre-auth surface, maximum severity, admin-equivalent code execution, a patch that closes the reported path and not the capability under it. That was the SAP surface this site mapped 14 years ago, and it is the SAP surface now.