Attackers Searching for SAP Netweaver Webshells

Published: 2026-11-09. Last Updated: 2026-11-09 18:18:15 UTC
by Johannes Ullrich (Version: 1)

Just saw a new (to me) URL in our honeypot data today:

/irj/servlet_jsp/irj/root/ant.jsp

This request is part of a larger campaign to exploit SAP NetWeaver or to find already installed webshells.

The exploited vulnerability is "old": CVE-2025-31324. A perfect 10 CVSS score and the simple ability to upload files without authentication. Attackers have been using this vulnerability to upload webshells. Usually, these webshells end up in /irj/servlet_jsp/irj/root/.

One particular attacker, 82.26.72.21, is hitting the following URLs. Not all of these URLs are SAP NetWeaver-related. Also, check the odd misspelling of "upload.aspx" at the end.

URL Path
/
/_layouts/15/start.aspx
/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx
/amp/upload
/ant.aspx
/ant.jsp
/ant.jsp/
/ant.php
/api/upload
/api/v1/upload
/authenticationendpoint/ant.jsp
/commandcenter/ant.jsp
/commandcenter/deployWebpackage.do
/developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1
/en-US/static/app/search/ant.php
/fileupload/toolsAny
/hosted/amp/upload
/images/ant.php
/images/pagebuilder/ant.php
/index.action
/index.php?option=com_baforms&task=uploader.upload
/index.php?option=com_gridbox&task=uploader.upload
/index.php?option=com_jce&task=plugin.display&plugin=browser
/index.php?option=com_sppagebuilder&task=media.directUpload
/irj/servlet_jsp/irj/root/ant.jsp
/m/webadmin/upload
/MagicInfo/ant.jsp
/MagicInfo/servlet/SWUpdateFileUploader
/NmConsole/ant.aspx
/NmConsole/Wug/Report/ExportReport
/Synchronization
/te/upload
/upload.apsx
/upload.aspx

--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|

Keywords: sap netweaver

1 comment(s)

ISC Stormcast For Monday, November 9th, 2026 https://isc.sans.edu/podcastdetail/10170

Internet Storm Center

Attackers Searching for SAP Netweaver Webshells

Comments