Skip to content
SAP Exploits Surge: Days to Zero Report Highlights Critical Vulnerabilities

SAP Exploits Surge: Days to Zero Report Highlights Critical Vulnerabilities

First seen 31 Oct 2026, 06:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 31, 2026 at 08:42 UTC
  • •Median time to exploit SAP vulnerabilities has dropped to 1-3 days.
  • •Over 30 ransomware groups are now targeting SAP systems.
  • •CVE-2025-31324 was actively exploited shortly after its disclosure.

A report from Onapsis Research Labs and Recorded Future reveals that the median time from the release of a SAP Security Note to the first public exploit has drastically decreased to 1-3 days, down from 489 days in 2021. The report analyzed over 1.2 million events and noted a 123% increase in underground discussions targeting SAP applications between 2023 and 2025. The rise in ransomware groups targeting SAP systems has been significant, with 30+ distinct groups identified. A critical vulnerability, CVE-2025-31324, was within weeks of its disclosure, leading to over 1,200 exposed instances. The report emphasizes the urgent need for organizations to enhance their SAP security measures as exploitation becomes increasingly rapid and sophisticated.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-04-24
CVE-2025-31324 published
A critical SAP NetWeaver zero-day vulnerability was disclosed, rated CVSS 10.0.
Security-Storage-Und-Channel-Germany.De
2025-04-26
First public PoC for CVE-2025-31324
Public proof-of-concept for the critical vulnerability was released, enabling further exploitation.
Security-Storage-Und-Channel-Germany.De
2025-04-29
CVE-2025-31324 added to CISA KEV
CISA included the critical vulnerability in its Known Exploited Vulnerabilities catalog due to active exploitation.
Security-Storage-Und-Channel-Germany.De

More articles in this cluster (2)

Following this threat?

Track Akira, SAP and CVE-2025-31324 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 3

Common questions

What is the significance of CVE-2025-31324?
CVE-2025-31324 is a critical vulnerability in SAP NetWeaver, actively exploited shortly after its disclosure.
How quickly are SAP vulnerabilities being exploited?
The median time from SAP Security Note release to exploitation has decreased to 1-3 days.
What should organizations do to protect against these threats?
Organizations should prioritize patching SAP systems and enhance monitoring for exploit attempts.