SAP RCE in the Wild, EoL Router Exploits, and Automating Defense

Vulnerability

SAP Patches Critical 'ICMAD' RCE Flaw in NetWeaver (CVE-2025-31324)

SAP has patched a critical deserialization flaw that allows remote code execution. If your stack runs on NetWeaver and you're not patching this immediately, you are leaving the front door unlocked for attackers.

Templates

Detect NetWeaver CVE-2025-31324 with New Nuclei Template

Project Discovery added a new template to detect CVE-2025-31324. It's the fastest way to audit your attack surface at scale to see if your environment is actually exposed to this SAP flaw without manual code review.

Watchlist

Active Exploitation: Cisco, Linksys, and Netgear Routers Under Attack

Attackers are actively hitting this specific set of EOL devices because they’ll never get a patch. If you have these in production, stop trying to defend them and rip them out of the network.

Advisory

CISA Adds to Known Exploited Vulnerabilities Catalog

CISA dropped this week's update detailing active exploitation in the wild. It’s a mandatory checklist for your security team to ensure your stack isn't sitting on a ticking time bomb.