On August 15, 2025, the cybersecurity landscape shifted as threat group ShinyHunters publicly released a weaponized exploit targeting critical SAP NetWeaver vulnerabilities through malware repository VX Underground. The exploit chains two vulnerabilities, CVE-2025-31324 and CVE-2025-42999, to achieve unauthenticated remote code execution on SAP systems, which form the backbone of financial operations for thousands of enterprises worldwide including many handling cryptocurrency and digital asset transactions.
The Threat Landscape
The released exploit specifically targets SAP NetWeaver Visual Composer, exploiting a missing authentication flaw tracked as CVE-2025-31324, which carries a maximum CVSS severity score of 10.0. This vulnerability allows an unauthenticated attacker to upload arbitrary files to the SAP server. When chained with CVE-2025-42999, a deserialization vulnerability discovered by Onapsis Research Labs, attackers can execute operating system commands with SAP administrator privileges without deploying any files on the target system.
The ShinyHunters group, which operates through a Telegram channel branded as “Scattered LAPSUS$ Hunters,” has demonstrated deep knowledge of SAP application architecture. Security researchers note that the exploit uses custom SAP classes such as com.sap.sdo.api.* as key building blocks and adjusts payloads based on the specific SAP NetWeaver version running on the target system.
Core Principles
Enterprise security in the cryptocurrency era requires defense in depth. SAP systems processing blockchain transactions, managing digital asset custody, or integrating with cryptocurrency exchanges represent high-value targets. The core principle is that perimeter security alone is insufficient when critical vulnerabilities exist in application layers.
Both CVE-2025-31324 and CVE-2025-42999 were already patched by SAP in April and May 2025 through Security Notes 3594142 and 3604119 respectively. However, the public release of a weaponized exploit dramatically lowers the barrier to entry for less sophisticated threat actors, meaning unpatched systems face imminent risk. Organizations running crypto-adjacent SAP implementations should prioritize applying these patches immediately.
Tooling and Setup
Onapsis and Mandiant have released open-source scanners on GitHub that allow organizations to assess their SAP environments for indicators of compromise related to these vulnerabilities. Running these scanners should be the first step in any response protocol. The scanner checks for known IOCs including web shell artifacts, unauthorized file uploads, and suspicious deserialization patterns.
Additional security measures include implementing network segmentation to restrict access to SAP NetWeaver Visual Composer endpoints, deploying web application firewalls with rules tuned to detect exploitation attempts, and enabling comprehensive logging on all SAP-facing systems. For cryptocurrency businesses, this means ensuring that SAP systems handling financial reporting or compliance data are isolated from internet-facing components.
Ongoing Vigilance
The publication of this exploit also raises concerns about related deserialization vulnerabilities patched by SAP in July 2025, including CVE-2025-30012, CVE-2025-42980, CVE-2025-42966, CVE-2025-42963, and CVE-2025-42964. The deserialization gadget published in the ShinyHunters exploit can potentially be reused against these vulnerabilities, creating a broader attack surface than initially anticipated.
Organizations should establish a continuous vulnerability management program for SAP systems, subscribe to SAP Security Note notifications, and maintain an asset inventory that maps all SAP components exposed to external networks. With Bitcoin trading above $117,000 and the crypto industry managing trillions in assets, the financial motivation for attacking enterprise systems connected to digital asset flows has never been higher.
Final Takeaway
The ShinyHunters SAP exploit release represents a watershed moment in enterprise security. The combination of publicly available weaponized code and the financial incentives presented by the cryptocurrency ecosystem means that unpatched SAP systems are no longer just a compliance risk but an active target. Apply patches, run scanners, segment networks, and monitor continuously. The tools are available; the urgency is real.
Disclaimer: This article is for informational purposes only and does not constitute security advice. Consult with qualified cybersecurity professionals for specific guidance on your organization’s security posture.
CVE-2025-31324 had a 10.0 CVSS score and SAP still took weeks to patch. enterprise change control is a joke when the vuln is unauthenticated RCE
publishing on VX Underground was the right call. responsible disclosure only works if the vendor actually responds. SAP clearly wasnt going to
chaining CVE-2025-31324 with CVE-2025-42999 to get RCE without deploying files is genuinely impressive tradecraft. ShinyHunters earned that one
chaining CVE-2025-31324 with CVE-2025-42999 to skip file deployment entirely is next level tradecraft. most exploits need a staging server. this one just runs commands
Bridge security is still the weakest link in the ecosystem
Katya Ivanova bridge security is weak but enterprise ERP systems are weaker. SAP runs 77% of global business transactions. a zero-day there makes every bridge hack look like a parking ticket
Kwame Mensah 77% of global business transactions on SAP and a CVSS 10.0 unauthenticated RCE. the blast radius on this is insane compared to any DeFi hack
CVE-2025-31324 with a 10.0 CVSS score and SAP still took weeks to patch in some cases. enterprise security is a joke
CVE-2025-31324 with CVSS 10.0 and SAP still didn’t prioritize it. Enterprise security is fundamentally broken when critical financial systems have these exposures.
the fact that this chains two vulns to get RCE without even deploying files is next level. Onapsis earned their money on this one
The amount of DeFi exploits is still way too high
a CVSS 10.0 vulnerability on SAP NetWeaver. that is the maximum severity score. this isnt a theoretical risk its a loaded gun aimed at enterprise financial systems
cvss_10_ and both CVEs were already patched in April and May. the exploit publication is dangerous because patching cycles in enterprise SAP run 6-12 months
erp_sec_ 6-12 month patch cycles in enterprise SAP is the real nightmare. fortune 500s dont patch fast, they have change control boards that meet monthly
patch_window_ monthly change control boards are why enterprises get breached. a CVSS 10.0 unauthenticated RCE needs a 48 hour patch window not a 30 day one. SAP support packages are archaic
Multi-sig wallets should be the default for everyone in crypto
The cost of a security breach always exceeds the cost of prevention
CVSS 10.0 with missing authentication on NetWeaver Visual Composer. SAP systems running critical financial ops for Fortune 500 companies and nobody patched this for months
ShinyHunters publishing on VX Underground instead of selling to brokers means the exploit was already burned. zero day value drops to zero once its public
ShinyHunters dropping this publicly instead of selling to brokers means the zero day value dropped to zero once disclosed. Companies need faster patch cycles.
ShinyHunters dropping this on VX Underground was a power move. every SAP admin in the world scrambling right now
The fact that this chains two CVEs to achieve RCE without file deployment is next level. SAP still takes 6-12 months on patch cycles despite critical vulnerabilities.
ShinyHunters publishing on VX Underground was a public service honestly. every SAP admin who ignored the Onapsis advisory in April had no excuse after August