#cve-2025-31324

Analysis · May 6, 2026 · Colten Anderson

SAP NetWeaver was owned for ten weeks before anyone said anything

Five threat groups were already inside SAP NetWeaver when the emergency patch shipped. One confirmed victim reported multi-billion dollar profit impact. SAP's initial workaround guidance was later marked 'Do Not Use.'