SAP Note 3594142

Missing Authorization check in SAP NetWeaver (Visual Composer development server)

CriticalCVSS 10.0Known exploitedSAP NetWeaver

CVE(s): CVE-2025-31324; CVE-2025-31324: Added to CISA KEV on April 29, 2025
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products and versions

Product SAP NetWeaver (Visual Composer development server)
Versions: VCFRAMEWORK 7.50

Appears in

Patch Days listing this note, newest first.

May 2025Updateupdate of April 2025 noteCriticalCVSS 10.0
April 2025NewReleased after Patch DayCriticalCVSS 10.0

Open note on SAP for Me (SAP login required)