Security Boulevard

Can Robust PAM Systems Make a Difference? We delve into the intricacies of Non-Human Identities (NHIs) and Secrets Security Management. A well-configured PAM system, especially for organizations operating, can be the cornerstone of a solid cybersecurity strategy. A Deep Dive into Non-Human Identities and Secrets: Non-Human Identities (NHIs) are the machine identities that play crucial […]

The post Feel Supported by Robust PAM appeared first on Entro.

The post Feel Supported by Robust PAM appeared first on Security Boulevard.

Author/Presenter: Suha Sabi Hussain

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – Ground Truth – Incubated Machine Learning Exploits: Backdooring ML Pipelines Using Input-Handling Bugs appeared first on Security Boulevard.

Qualys this week added a tool that makes it possible for organizations to continuously run audits in a way that promises to dramatically reduce failure rates.

The post Qualys Adds Tool to Automate Audit Workflows appeared first on Security Boulevard.

Amazingly, Medium has fixed the stats so my blog/podcast quarterly is back to life. As before, this covers both Anton on Security and my posts from Google Cloud blog, and our Cloud Security Podcast (subscribe).

Dall-E security blogging image

Top 10 posts with the most lifetime views (excluding paper announcement blogs, Medium posts only):

1. Security Correlation Then and Now: A Sad Truth About SIEM
2. Can We Have “Detection as Code”?
3. Detection Engineering is Painful — and It Shouldn’t Be (Part 1)
4. NEW Anton’s Alert Fatigue: The Study
5. Revisiting the Visibility Triad for 2020 (update for 2025 is coming soon)
6. Beware: Clown-grade SOCs Still Abound
7. Why is Threat Detection Hard?
8. A SOC Tried To Detect Threats in the Cloud … You Won’t Believe What Happened Next
9. Top 10 SIEM Log Sources in Real Life? [updated/modified version]
10. How to Think about Threat Detection in the Cloud

Top posts with paper announcements:

• New Paper: “Future of the SOC: SOC People — Skills, Not Tiers”
• New Paper: “Future of the SOC: Forces shaping modern security operations”
• New Paper: “Future Of The SOC: Process Consistency and Creativity: a Delicate Balance” (Paper 3 of 4)
• New Paper: “Future of the SOC: Evolution or Optimization — Choose Your Path” (Paper 4 of 4.5)
• New Paper: “Future of SOC: Transform the ‘How’” (Paper 5)
• New Paper: “Autonomic Security Operations — 10X Transformation of the Security Operations Center” (the classic 2021 ASO paper!)
• New Paper: “Securing AI: Similar or Different?“ (update for 2025 coming soon!)

NEW: recent 3 fun posts, must-read:

• Anton’s Alert Fatigue: The Study (long!)
• The Return of the Baby ASO: Why SOCs Still Suck?
• 15+ Years of Loading Threat Intel into SIEM: Why Does This Still Suck?

Top 7 Cloud Security Podcast by Google episodes (excluding the oldest 3!):

1. EP75 How We Scale Detection and Response at Google: Automation, Metrics, Toil (our best episode! officially!)
2. EP8 Zero Trust: Fast Forward from 2010 to 2021
3. EP47 “Megatrends, Macro-changes, Microservices, Oh My! Changes in 2022 and Beyond in Cloud Security”
4. EP17 Modern Threat Detection at Google
5. EP109 How Google Does Vulnerability Management: The Not So Secret Secrets!
6. EP103 Security Incident Response and Public Cloud — Exploring with Mandiant
7. EP153 Kevin Mandia on Cloud Breaches: New Threat Actors, Old Mistakes, and Lessons for All

Now, fun posts by topic.

Security operations / detection & response:

• “Security Correlation Then and Now: A Sad Truth About SIEM”
• “Migrate Off That Old SIEM Already!” (VIDEO!)
• “Measuring the SOC: What Counts and What Doesn’t in 2025?” (Google Cloud Blog)
• “Can We Have “Detection as Code”?”
• “Revisiting the Visibility Triad for 2020”
• “Beware: Clown-grade SOCs Still Abound”
• “Why is Threat Detection Hard?”
• “A SOC Tried To Detect Threats in the Cloud … You Won’t Believe What Happened Next”
• “Stop Trying to Take Humans Out of SOC … Except … Wait… Wait… Wait…”
• “Top 10 SIEM Log Sources in Real Life?” (NEWER VERSION)
• “Debating SIEM in 2023, Part 1”
• “Debating SIEM in 2023, Part 2”
• “Log Centralization: The End Is Nigh?”
• “How to Make Threat Detection Better?”
• “SIEM Content, False Positives and Engineering (Or Not) Security”
• “Modern SecOps Masterclass: Now Available on Coursera”

(if you only read one, choose this one!)

Cloud security:

• “Using Cloud Securely — The Config Doom Question”
• “Who Does What In Cloud Threat Detection?”
• “How to Solve the Mystery of Cloud Defense in Depth?”
• “Does the World Need Cloud Detection and Response (CDR)?”
• “Use Cloud Securely? What Does This Even Mean?!”
• “How CISOs need to adapt their mental models for cloud security” [GCP blog]
• “Who Does What In Cloud Threat Detection?”
• “Cloud Migration Security Woes”
• “Move to Cloud: A Chance to Finally Transform Security?”
• “It’s a multicloud jungle out there. Here’s how your security can survive“

HGD:

• “How Google Does It: Finding, tracking, and fixing vulnerabilities” (Google Cloud blog)
• “How Google Does It: Red teaming at scale” (Google Cloud blog)

CISO, culture, FMC, etc

• “New Office of the CISO Paper: Organizing Security for Digital Transformation”
• “10 ways to make cyber-physical systems more resilient”

AI security:

• ”Our Security of AI Papers and Blogs Explained” [this has a whole lot of AI security fun links that you so want to click!]
• “Securing AI Supply Chain: Like Software, Only Not” (Google Cloud blog, 30K views…)
• “Spotlighting ‘shadow AI’: How to protect against risky AI practices” (part 1)
• “Shadow AI Strikes Back: Enterprise AI Absent Oversight in the Age of Gen AI” (part 2)
• “New Paper: “Securing AI: Similar or Different?“
• “The Prompt: What to think about when you’re thinking about securing AI”
• “Gen AI governance: 10 tips to level up your AI program”
• “AI Adoption: Learning from the Cloud’s Early Days”
• NEW: “Demystifying AI Security: New Paper on Real-World SAIF Applications”
• “To securely build AI on Google Cloud, follow these best practices”
• “Oops! 5 serious gen AI security mistakes to avoid”
• “3 new ways to use AI as your security sidekick” (Google Cloud blog)

(if you only read one, choose this one!)

NEW: fun presentations shared:

• Detection Engineering Maturity — Helping SIEMs Find Their Adulting Skills (2024)
• Future of SOC: More Security, Less Operations (2024)
• SOC Meets Cloud: What Breaks, What Changes, What to Do? (2023)
• Meet the Ghost of SecOps Future (2023)
• The Future of Log Centralization for SIEMs and DFIR — Is the End Nigh? (2023)
• 20 Years of SIEM (2022)

Enjoy!

Previous posts in this series:

• Anton’s Security Blog Quarterly Q4 2024
• Anton’s Security Blog Quarterly Q3 2024
• Anton’s Security Blog Quarterly Q2 2024
• Anton’s Security Blog Quarterly Q1 2024 Lite
• Anton’s Security Blog Quarterly Q3 2023
• Anton’s Security Blog Quarterly Q2 2023
• Anton’s Security Blog Quarterly Q1 2023
• Anton’s Security Blog Quarterly Q4 2022
• Anton’s Security Blog Quarterly Q3 2022
• Anton’s Security Blog Quarterly Q2 2022
• Anton’s Security Blog Quarterly Q1 2022
• Anton’s Security Blog Quarterly Q4 2021
• Anton’s Security Blog Quarterly Q3 2021
• Anton’s Security Blog Quarterly Q2 2021
• Anton’s Security Blog Quarterly Q1 2021
• Anton’s Security Blog Quarterly Q3.5 2020

Anton’s Security Blog Quarterly Q1 2025 was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Anton’s Security Blog Quarterly Q1 2025 appeared first on Security Boulevard.

Are You Fully Satisfied with Your Current Secrets Management? How often do you question the effectiveness of your secrets management processes? It’s paramount to ensure the processes and tools employed in secrets management are keeping pace with ever-advancing technology. Finding a solution that ensures your Non-Human Identities (NHIs) are well-managed and secure in your cloud […]

The post Satisfied with Your Secrets Management? appeared first on Entro.

The post Satisfied with Your Secrets Management? appeared first on Security Boulevard.

Is Your Enterprise Leveraging NHI Management Innovations? Every organization operating in our interconnected digital era must adopt modern cybersecurity measures to safeguard their data and systems. But how many are aware of the critical role Non-Human Identities (NHIs) play in achieving this? NHIs are machine identities birthed in cybersecurity. These unique identities are a combination […]

The post Innovations in Non-Human Identity Management appeared first on Entro.

The post Innovations in Non-Human Identity Management appeared first on Security Boulevard.

Is your organization truly secure against Secrets sprawl? Cloud-based firms face a growing wave of identity and secrets security challenges. Among these, the phenomenon of Secrets sprawl threatens to jeopardize the integrity of data and IT systems. Unchecked, it opens the door to an array of potential digital threats. But fear not, there is a […]

The post Are You Free from Secrets Sprawl Worry? appeared first on Entro.

The post Are You Free from Secrets Sprawl Worry? appeared first on Security Boulevard.

CISA's Supply Chain Integrity Month reminds us of an undeniable truth about modern software development: transparency in software supply chains is no longer optional. The theme of week 4 is "Transparency: Securing Hardware and Software Across the Supply Chain." With more than 90% of modern software applications relying on open source, this message couldn't be more timely. Transparency is at the heart of the current trend in legislative action, which puts a spotlight on the way agencies evaluate, purchase, and monitor software.

The post How SBOMs power secure software acquisition | Sonatype Blog appeared first on Security Boulevard.

Timely vulnerability remediation is an ongoing challenge for organizations as they struggle to prioritize the exposures that represent the greatest risk to their operations. Existing scoring systems are invaluable but can lack context. Here’s how Tenable’s Vulnerability Watch classification system can help.

Background

Over the past six years working in Tenable’s research organization, I’ve watched known vulnerabilities and zero-day flaws plague organizations in the immediate aftermath of disclosure or even years afterwards. Following each blog post or threat report we’ve published, I kept coming back to the same question: Why are so many organizations struggling to remediate vulnerabilities in a timely manner?

As someone who followed the evolution of COVID-19 variants throughout the beginning of the pandemic, I saw that the World Health Organization (WHO) began to label new variants under a classification system as the virus began to mutate. This classification system was designed to help prioritization efforts for monitoring and research. It included accessible labels like variants of interest and variants of concern to help communicate urgency and focus global attention.

I began to wonder: What if we borrowed from the same type of classification system used by the WHO and applied it to vulnerability intelligence? Numeric-based systems like the Common Vulnerability Scoring System (CVSS) and Exploit Prediction Scoring System (EPSS) provide mechanisms for prioritization based on scoring. However, they don’t always provide enough context to help decision makers. So, what if we used simple, clear and status-based terminology to communicate risks surrounding vulnerabilities in order to guide action?

This led us to develop Vulnerability Watch, a classification system for vulnerabilities inspired by the WHO’s classification of COVID-19 variants. Vulnerability Watch is a small, but important part of Tenable’s Vulnerability Intelligence offering that was launched in 2024. Now, in addition to being available in product, Vulnerability Watch classifications can be found on the Tenable CVE page, as well as within individual CVE pages for select vulnerabilities that have been classified under the Vulnerability Watch.

In this blog, we discuss some of the challenges organizations face when it comes to vulnerability prioritization and remediation and how a classification system like Vulnerability Watch can help.

If everything is important, nothing is important

CVSS is the most widely used metric when assigning a severity score for Common Vulnerabilities and Exposures (CVEs). CVSS scores are assigned by a vendor and or an authority like the National Institute of Standards and Technology (NIST). Each CVE score is based on various metrics from exploitability to impact, with a corresponding severity level tied to these scores. Severity levels include low, medium, high and critical.

When looking at repositories, such as the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, we can make observations about severity and vulnerability risk. In 2024, CISA added a total of 186 CVEs to the KEV.

Source: Tenable Research

Four in ten (40%) of these 186 CVEs were rated as critical. The remaining 60% was made up of high severity vulnerabilities (46.2%) and medium vulnerabilities(13.4%). This underscores that severity alone is not enough when it comes to making decisions around vulnerability prioritization.

Remediation rates underscore a need for more clarity

While the KEV serves as a valuable resource for security practitioners, we still see many organizations not patching these critical flaws in a timely manner. Despite the severity and inclusion on the KEV, our research has found an overall trend of poor remediation rates.

This trend was highlighted as part of a collaboration with Verizon on the 2025 Data Breach Investigations Report (DBIR). Tenable Research analyzed over 160 million data points and evaluated the remediation rates for a list of 17 CVEs in edge devices highlighted in the DBIR. Of the 17 CVEs, over half (52.9%) were non-critical flaws (less than 9.0 CVSS scores).

We also analyzed average remediation rates for these CVEs across various industry sectors. Through this analysis, we found many industries faced challenges with remediating many of these flaws. For instance, CVE-2024-21762 and CVE-2024-23113, a pair of critical Fortinet flaws, had very long remediation rates, averaging between 172 days and 260 days. Even CVE-2024-3400, a critical vulnerability in Palo Alto Networks PAN-OS assigned the maximum CVSS score of 10.0, also saw most industries average over 100 days to remediate the flaw.

There are a variety of reasons why organizations may struggle with remediation — including organizational siloes, operational downtime required to patch systems, and difficulty determining how to prioritize vulnerabilities based on the risk they represent. While existing scoring systems provide invaluable guidance, we believe additional context is needed in order to improve remediation times.

A semantic layer for vulnerability intelligence

Our Vulnerability Watch classifications are not a replacement for CVSS, EPSS or any other scoring metric. Those still serve a distinct purpose in vulnerability prioritization. We also recognize that cybersecurity teams are often inundated by a deluge of alerts and it can be difficult at times to separate the signal from the noise. These vulnerability watch classifications offer a semantic layer to help translate risk into terminology that is easier to understand for various stakeholders in remediation efforts.

Tenable’s Vulnerability Watch classifications

Vulnerability Watch includes the following classifications: vulnerability being monitored, vulnerability of interest and vulnerability of concern. The following are short descriptions of each classification.

Vulnerability Being Monitored

A vulnerability being monitored (VBM) is a vulnerability that has the potential to impact customers of a particular software or hardware and is being actively tracked and researched by Tenable Research. VBMs may quickly evolve into Vulnerabilities of Interest (VOIs) or Vulnerabilities of Concern (VOCs) if a proof-of-concept (PoC) or exploitation is discovered, or if additional intelligence indicates that special attention should be given to this vulnerability. VBMs are actively monitored and elevated to VOI/VOC status should Tenable’s Vulnerability Intelligence justify an escalation of vulnerability status.

A few recent examples of VBMs include CVE-2024-48887, an unverified password change vulnerability in FortiSwitch, and CVE-2025-23120, a remote code execution flaw in Veeam Backup and Replication.

Vulnerability of Interest

A vulnerability of interest (VOI) is a vulnerability that meets the criteria of a VBM, but for which additional intelligence indicates that risk of impacts to customers is elevated or demonstrated through the publication of a PoC or details that could be used to craft a PoC along with initial reports of exploitation.

A few recent examples of VOIs include CVE-2025-22457, which was exploited by a China-Nexus threat actor known as UNC5221, and CVE-2025-32433, a remote code execution flaw in Erlang/OTP SSH.

Vulnerability of Concern

A Vulnerability of Concern (VOC) is a vulnerability that meets the criteria of a VOI, but for which active, widespread exploitation is imminent or ongoing. For VOCs, the ease of exploitation combined with severity of the issue may lead us to believe that widespread exploitation is imminent, if it has not already begun. Maintainers of software or devices vulnerable to VOCs can expect to see exploitation attempts and probing for vulnerable assets.

A few recent examples of VOCs include a pair of ConnectWise Screen Connect vulnerabilities (CVE-2024-1709, CVE-2024-1708) and Citrix Bleed (CVE-2023-4966).

The classifications are also flexible: a CVE can be reclassified from VBM to VOI, from VOI to VOC, or even from VOC back to VOI as risk context evolves.

Conclusion

We know there’s no single panacea for the challenges of vulnerability prioritization and remediation. These challenges require a multi-pronged approach. Backed by Tenable Research experts, our Vulnerability Watch classifications can help demystify some of the complexities introduced by CVSS and EPSS and provide stakeholders a simpler, more intuitive way to assess and prioritize risks posed by emerging threats that can contribute to faster responses and remediation.

Our Vulnerability Watch classifications can now be found on our CVE page.

Get more information

• Tenable Vulnerability Intelligence and Exposure Response
• Turning Data into Action: Intelligence-Driven Vulnerability Management

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

The post Reducing Remediation Time Remains a Challenge: How Tenable Vulnerability Watch Can Help appeared first on Security Boulevard.

The software supply chain has never been more complex — or more critical to secure. For years, the Software Bill of Materials (SBOM) has been the go-to tool for documenting components within software, offering much-needed visibility into what’s under the hood. It is called out by Executive Order 14028, as well as the EU Digital Operational Resilience Act (DORA) and EU Cyber Resilience Act (CRA). But as software systems grow to include machine learning models, cloud services, cryptographic risks, hardware dependencies, and low-code platforms, the traditional SBOM simply isn’t enough.

The SBOM has been fully supported by the OWASP Foundation’s CycloneDx, an industry-recognized standard for machine-readable SBOMs. And in 2023, CycloneDx introduced the Extended Bill of Materials (xBOM) to address the full stack bill of materials, adding 11 other bills of materials (BOMs) for areas that span software as a service, cryptography, hardware, manufacturing and other technology ecosystems. In its most current form, CycloneDX v1.6 was ratified as an Ecma International standard, providing a global xBOM specification for use across multiple domains.

Here's what you need to know about the SBOM’s purpose, what the xBOM entails — and how RL Spectra Assure now provides the most comprehensive support for the xBOM.

The post What is the xBOM? appeared first on Security Boulevard.

Author/Presenter: Ezz Tahoun

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – Ground Truth – ZERO-RULES Alert Contextualizer & Correlator appeared first on Security Boulevard.

New research demonstrates cyberattacks on the application layer often evade the most common tools, Endpoint Detection and Response (EDR) and web application firewalls (WAFs). Contrast Labs spent several weeks testing several attack methods to determine whether WAFs or EDR solutions stop and/or catch most damaging software attacks. 

The post ADR vs EDR and WAF | Application Security Tool Comparison | Contrast Security appeared first on Security Boulevard.

Apr 25, 2025 - Alan Fagan - Washington, D.C. — 25th April 2025 — FireTail, the leading AI & API security platform, has released its annual report, The State of AI & API Security 2025, revealing a critical blind spot in the way organizations are securing their AI investments. Despite record-breaking AI adoption, the report warns that most enterprises are overlooking the most exposed part of the AI stack: the API layer.
“APIs are the foundation of AI applications, and attackers know it,” said Jeremy Snyder, Co-founder and CEO at FireTail. “If you don’t secure your APIs, you’re not securing your AI. It’s that simple.”
The report is based on research and analysis from FireTail’s API Breach Tracker, its AI Incident Tracker, telemetry from production environments, and detailed reviews of major AI-related security incidents. It provides concrete evidence that APIs are not just enabling AI, but exposing it.
Key Insights from the Report
In 2024, FireTail tracked 26 major API security incidents, an increase from 22 in the previous year. It showed that attackers continue to exploit long-standing vulnerabilities such as authorization flaws, weak authentication, and insufficient input validation. Since 2017, more than 1.6 billion records have been exposed via API-related incidents.
The report also examines high-profile cases including the Irish Government’s vaccination portal, OpenAI’s web crawler, and Meta’s LLaMA framework.
“We’re already seeing the first wave of large-scale AI breaches,” Snyder said. “And it’s clear that organizations are rushing to adopt AI without proper security oversight.”
A Growing Attack Surface and A Lack of Visibility
Research shows that 97% of organizations believe AI introduces unique security challenges, yet nearly 60% say they lack visibility into the APIs powering their AI systems. This gap is creating opportunities for attackers to exploit shadow APIs, bypass controls, and launch techniques like prompt injection and model poisoning.
The report also highlights the regulatory shift taking place. The FCC’s $16 million enforcement action against TracFone over API vulnerabilities shows that regulators now view API security failures as compliance violations rather in addition to being technical and security oversights.
Frameworks like the CIS API Security Guide, OWASP LLM Top 10, and ISO 42001 are beginning to provide much-needed structure. However, FireTail argues that these must be paired with proactive discovery, posture management, and runtime protection to be truly effective.
A Call for API-First Security
The State of AI & API Security 2025 calls for an API-centric approach to securing AI. Key recommendations include comprehensive API discovery, strong authentication and authorization, secure-by-design development, and continuous monitoring.
“AI doesn’t exist in a vacuum. It’s connected to everything, and that connection point is the API,” said Snyder. “If organizations want to innovate safely with AI, they need to start by securing the APIs that power it.”
Access the Report
The State of AI & API Security 2025 is available for download at: https://www.firetail.ai/reports/the-state-of-ai-and-api-security-2025

The post AI Innovation at Risk: FireTail’s 2025 Report Reveals API Security as the Weak Link in Enterprise AI Strategies – FireTail Blog appeared first on Security Boulevard.

One of the most critical elements of modern information security is encryption. Encryption is a complex field based solely on the arms race between people seeking secure ways to encode and encrypt data at rest and in transit and those seeking to break that encryption. Encryption is extremely commonplace. Most websites you visit use SSL, […]

The post Guide: What is KMI (Key Management Infrastructure)? appeared first on Security Boulevard.

When we think about vishing (voice phishing), the usual suspects come to mind: fake refund scams impersonating Norton, PayPal, or Geek Squad.

The post New Spin on Vishing: Attackers Are Now Targeting Healthcare Appointments appeared first on Security Boulevard.

The North Korean hackers behind the Contagious Interview worker scam, which threat intelligence analysts have followed since late 2023, are now hiding behind three bogus crypto companies they created as fronts for their info- and crypto-stealing operations.

The post North Korean Group Creates Fake Crypto Firms in Job Complex Scam appeared first on Security Boulevard.

You may have seen the “no-lift pencil” puzzles online — challenges that ask you to draw a shape without lifting your pencil or retracing any lines. I solved a few of these on our whiteboard at home, much to my kids’ amazement. Of course, I had a trick up my sleeve: I was using math. […]

The post Euler’s Königsberg Bridges: How Simple Math Can Model Lateral Movement for Effective Microsegmentation appeared first on ColorTokens.

The post Euler’s Königsberg Bridges: How Simple Math Can Model Lateral Movement for Effective Microsegmentation appeared first on Security Boulevard.

HiddenLayer this week disclosed its researchers have discovered a prompt injection technique that bypasses instruction hierarchy and safety guardrails across all the major foundational artificial intelligence (AI) models.

The post HiddenLayer Researchers Surface Prompt Technique Bypassing All AI Guardrails appeared first on Security Boulevard.

Don’t say ‘spyware’—21 million screenshots in one open bucket.

The post 200,000 Workers’ PII at Risk in WorkComposer S3 SNAFU appeared first on Security Boulevard.

SAP has released out-of-band patch to address CVE-2025-31324, a critical zero-day vulnerability in SAP NetWeaver that has been exploited by threat actors. Organizations are strongly encouraged to apply patches as soon as possible.

Background

On April 22, ReliaQuest published details of their investigation of exploit activity in SAP NetWeaver servers. Initially it was unclear if their discovery was a new vulnerability or the abuse of CVE-2017-9844, a vulnerability that could lead to a denial-of-service (DoS) condition or arbitrary code execution. ReliaQuest reported their findings to SAP and on April 24, SAP disclosed CVE-2025-31324, a critical missing authorization check vulnerability with the highest severity CVSS score of 10.0.

CVE Description CVSSv3 VPR CVE-2025-31324 SAP NetWeaver Unauthenticated File Upload Vulnerability 10.0 8.1

*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on April 25 and reflects VPR at that time.

Analysis

CVE-2025-31324 is an unauthenticated file upload vulnerability affecting the Metadata Uploader component of SAP NetWeaver Visual Composer. Successful exploitation of this vulnerability could allow an unauthenticated attacker to upload malicious files which can be used by an attacker to achieve code execution. The flaw is the result of missing authorization checks to the “/developmentserver/metadatauploader” endpoint. According to ReliaQuest, this vulnerability has been exploited in the wild as a zero-day by threat actors who have abused the flaw to upload malicious web shells to affected hosts. These webshells were used to deploy malware and establish communications with command and control (C2) servers.

Proof of concept

At the time this blog was published, no proof-of-concept (PoC) code had been published for CVE-2025-31324. If a public PoC exploit becomes available, we anticipate a variety of attackers will attempt to leverage this flaw in their attacks as SAP products are widely used by a variety of organizations, including government agencies.

Solution

SAP has released patches for affected versions of SAP NetWeaver. At this time, the SAP security note #3594142 is not publicly accessible, so we are unable to provide a list of affected and patched versions. It is important to note that these patches were released after SAP’s April 2025 Security Patch Day published on April 8. So even if those patches were applied, you will still need to apply the out-of-band patches released for CVE-2025-31324.

Identifying affected systems

A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2025-31324 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.

Additionally, customers can utilize Tenable Attack Surface Management to identify public facing assets running SAP NetWeaver by using the following filters:

Get more information

• ReliaQuest Blog: ReliaQuest Uncovers New Critical Vulnerability in SAP NetWeaver
• SAP Security Patch Day - April 2025

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

The post CVE-2025-31324: Zero-Day Vulnerability in SAP NetWeaver Exploited in the Wild appeared first on Security Boulevard.