🚨 We have a detection up for SAP NetWeaver CVE-2025-31324 Unauthenticated File Upload Attempt
I can confirm we have had hits on it before the tag being published (we're working on a retro-hunt).
These IPs were seen making the attempts over the weekend:
98.84.54.227
67.205.148.188
85.90.245.101
89.117.19.46
172.105.246.67
212.56.35.88
This is the tag:
https://viz.greynoise.io/tags/sap-netweaver-cve-2025-31324-unauthenticated-file-upload-attempt?days=30