SAP Patch Day März 2026: Zwei HotNews-Lücken in Log4j und NetWeaver geschlossen
Im Fokus stehen eine seit Jahren bekannte Log4j-Komponente und eine Deserialisierungslücke im NetWeaver Enterprise Portal.
SAP schließt im März 20 Sicherheitslücken – darunter zwei HotNews mit CVSS 9,8 und 9,1. Alle Patches im Überblick.
SAP NetWeaver Memory Corruption Flaw Lets Attackers Send Corrupted Logon Tickets
https://gbhackers.com/sap-netweaver-memory-corruption-flaw/
#Infosec #Security #Cybersecurity #CeptBiro #SAP #NetWeaver #MemoryCorruption #CorruptedLogonTickets
Selon BleepingComputer, SAP a publié son bulletin sécurité de septembre détaillant 21 nouvelles vulnérabilités, dont trois failles critiques affectant principalement SAP NetWeaver. NetWeaver est le socle de multiples apps SAP (ERP, CRM, SRM, SCM) et est largement déployé en entreprise. 🔴 CVE-2025-42944 (CVSS 10.0) — Désérialisation non sécurisée dans SAP NetWeaver (RMIP4), ServerCore 7.50. Un attaquant non authentifié peut exécuter des commandes OS arbitraires en envoyant un objet Java malveillant via le module RMI-P4 vers un port ouvert. Le protocole RMI-P4, utilisé par NetWeaver AS Java pour la communication interne SAP-to-SAP ou l’administration, peut être exposé au-delà de l’hôte (voire à Internet) en cas de mauvaise configuration réseau (pare-feu, etc.).
#GoogleChrome #ChromeBrowserChinese #Hackers #Exploit SAP #RCE Flaw CVE-2025-31324, Deploy Golang-Based #SuperShell
CVE-2025-31324 refers to a critical #SAP #NetWeaver flaw that allows attackers to achieve remote code execution (RCE) by uploading web shells through a susceptible "/developmentserver/metadatauploader" endpoint
#security
https://thehackernews.com/2025/05/chinese-hackers-exploit-sap-rce-flaw.html
A critical SAP vulnerability scoring 10/10 is actively being exploited to deploy ransomware across enterprise systems. Security experts from ReliaQuest warn this zero-day flaw in NetWeaver could compromise corporate and government data worldwide. Learn how to protect your organization now.
#SecurityLand #CyberWatch #ZeroDay #Vulnerability #SAP #NetWeaver #EnterpriseSecurity
🚨 SAP NetWeaver Zero-Day Under Active Exploitation — Patch Immediately
SAP has released an out-of-band emergency update to fix a critical zero-day vulnerability (CVE-2025-31324) in NetWeaver Visual Composer — and it’s already being exploited in the wild.
The flaw (CVSS 10.0) allows unauthenticated remote attackers to upload malicious files and gain full remote code execution — no login required.
Here’s what’s happening:
- Threat actors are abusing the `/developmentserver/metadatauploader` endpoint
- They're dropping JSP web shells and executing commands directly from browsers
- Post-exploitation activity includes tools like Brute Ratel and MSBuild injection for stealth
- Even fully patched systems were compromised — confirming this was a true zero-day
Both ReliaQuest and watchTowr have confirmed active exploitation, with attackers already moving to establish persistence and lateral movement.
Who’s affected:
- SAP NetWeaver Visual Composer 7.50 environments
- Systems exposed to the internet, especially if Visual Composer is enabled
What you need to do:
- Apply the emergency patch from SAP (released after the April 8 update)
- If you can’t patch immediately:
- Restrict access to the vulnerable endpoint
- Disable Visual Composer if unused
- Forward logs to SIEM and scan for unauthorized servlet uploads
Also included in the emergency update:
- CVE-2025-27429 — Code injection in SAP S/4HANA
- CVE-2025-31330 — Code injection in SAP Landscape Transformation
In a world where zero-days are increasingly exploited within hours of discovery, patching isn’t optional — it’s urgent.
AllAboutSecurity
Rene Robichaud
CyberVeille.ch
WALLSEC GmbH
Marcel SIneM(S)US
PrivacyDigest
securityaffairs
Security Land
Efani