CVE report
CVE-2025-31324criticalKEV
SAP NetWeaver Visual Composer Metadata Uploader - Deserialization
Events 90d
507
Distinct IPs
432
Severity
critical
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2025-31324 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /developmentserver/metadatauploader
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 20 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2025-31324
- 192.142.28.7712 eventsThe Netherlands· Hostpalace Datacenters Ltd
- 20.163.25.2314 eventsUnited States
- 20.115.90.2283 eventsUnited States
- 20.64.105.1833 eventsUnited States
- 172.203.225.2213 eventsUnited States
- 20.64.106.293 eventsUnited States
- 20.163.30.2053 eventsUnited States
- 20.221.72.1742 eventsUnited States
- 20.40.216.1172 eventsUnited States
- 20.64.105.322 eventsUnited States
- 48.214.144.1912 eventsUnited States
- 20.163.14.512 eventsUnited States
- 172.202.104.712 eventsUnited States
- 20.163.2.352 eventsUnited States
- 20.98.137.2252 eventsUnited States
- 20.65.137.2182 eventsUnited States
- 20.29.19.1562 eventsUnited States
- 20.118.216.2212 eventsUnited States
- 20.55.36.632 eventsUnited States
- 52.180.145.982 eventsUnited States
- 20.15.162.2382 eventsUnited States
- 135.237.126.182 eventsUnited States
- 20.64.104.1412 eventsUnited States
- 172.202.117.1962 eventsUnited States
- 20.83.49.342 eventsUnited States
- 20.65.194.1322 eventsUnited States
- 40.124.172.1462 eventsUnited States
- 20.64.104.822 eventsUnited States
- 20.169.49.232 eventsUnited States
- 20.51.234.2332 eventsUnited States
Top networks the attempts come from
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
Sample request paths observed
- /developmentserver/metadatauploader
- /developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1