Netskope Threat Labs

ET EXPLOIT SAP NetWeaver Visual Composer Metadata Uploader Unauthenticated JSP File Upload (CVE-2025-31324)

IPS-NPA

1 SID: 2064148

Detects payload upload activity associated with the SAP NetWeaver Visual Composer Metadata Uploader Unauthenticated JSP malware family. The underlying exploit code targets CVE-2025-31324.