{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"SAP NetWeaver Under Siege: New Exploit Chains Threaten Global Enterprises","html":"","width":"100%","height":180,"duration":2693,"description":"SAP NetWeaver, one of the world’s most critical enterprise platforms, is under active attack from both ransomware groups and state-backed hackers. A newly released exploit combines two devastating vulnerabilities—CVE-2025-31324 and CVE-2025-42999—to bypass authentication and execute malicious code with full administrative privileges. With CVSS scores of 10.0 and 9.1, these flaws rank among the most severe ever discovered in SAP systems.\nAlthough SAP issued patches earlier this year, dozens of unpatched NetWeaver servers remain exposed, leaving organizations vulnerable to complete compromise. The attack chain is straightforward but highly effective:\nExploit CVE-2025-31324 (missing authorization check) to upload malicious payloads without authentication.\nTrigger CVE-2025-42999 (insecure deserialization) to execute the uploaded code at SAP system privilege level.\nThe result: Remote Code Execution (RCE), enabling attackers to hijack business-critical applications, steal sensitive data, alter financial records, or deploy ransomware across entire corporate landscapes.\nThreat actors exploiting these flaws include:\nChina-linked APTs such as UNC5221, UNC5174, CL-STA-0048, and Earth Lamia, known for espionage and long-term persistence operations.\nRussian ransomware groups like BianLian, RansomEXX, and Qilin, who are actively monetizing these exploits through extortion and disruption.\nSecurity experts warn that the insecure deserialization technique underpinning CVE-2025-42999 could resurface in future SAP vulnerabilities, making this exploit chain part of a broader, evolving threat landscape.\nThe stakes are enormous. Victims already include critical infrastructure sectors:\nNatural gas and water utilities in the UK\nOil and gas producers in the U.S.\nMedical device manufacturers\nGovernment ministries in Saudi Arabia\nThe business consequences range from PII exposure and data corruption to ransomware-driven outages reminiscent of high-profile ERP disruptions in recent years....","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}