---
title: Hunt: scanners are checking SAP NetWeaver for leftover ant.jsp webshells from CVE-2025-31324, alongside dozens of other upload paths | ctxsec
url: https://ctxsec.com/items/hunt-sap-netweaver-ant-jsp-webshell-sweeps-cve-2025-31324-isc-nov-9
description: "SANS ISC saw a new honeypot request for /irj/servlet_jsp/irj/root/ant.jsp, the directory where webshells dropped through SAP NetWeaver's CVE-2025-31324 unauthenticated upload usually land. One source, 82.26.72.21, requested it as part of a wider sweep for upload endpoints and existing ant.* shells across SharePoint, Joomla extensions, Samsung MagicInfo, WhatsUp Gold and other products, so already-compromised servers are being looked for, not just new ones."
status: "honeypot observation (SANS ISC, Johannes Ullrich, Nov 9); CVE-2025-31324 is an older, already-KEV-listed SAP NetWeaver flaw"
published: 2026-11-09
---

> SANS ISC saw a new honeypot request for /irj/servlet_jsp/irj/root/ant.jsp, the directory where webshells dropped through SAP NetWeaver's CVE-2025-31324 unauthenticated upload usually land. One source, 82.26.72.21, requested it as part of a wider sweep for upload endpoints and existing ant.* shells across SharePoint, Joomla extensions, Samsung MagicInfo, WhatsUp Gold and other products, so already-compromised servers are being looked for, not just new ones.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-sap-netweaver-ant-jsp-webshell-sweeps-cve-2025-31324-isc-nov-9.md)

honeypot observation (SANS ISC, Johannes Ullrich, Nov 9); CVE-2025-31324 is an older, already-KEV-listed SAP NetWeaver flaw

2026-11-09

### Hunt: scanners are checking SAP NetWeaver for leftover ant.jsp webshells from CVE-2025-31324, alongside dozens of other upload paths

- **On SAP NetWeaver:** look for unexpected `.jsp` files under `/irj/servlet_jsp/irj/root/` and requests to `/developmentserver/metadatauploader`; a hit on `ant.jsp` returning 200 means a shell is present.
- **Other paths in the same sweep:** `/ant.jsp`, `/ant.aspx`, `/ant.php`, `/MagicInfo/servlet/SWUpdateFileUploader`, `/NmConsole/Wug/Report/ExportReport`, `/_layouts/15/ToolPane.aspx?DisplayMode=Edit`, `/commandcenter/deployWebpackage.do` and Joomla `uploader.upload` tasks.
- **Source to block or look up:** `82.26.72[.]21`.
- Note the misspelled `/upload.apsx` in the list, which can make a useful low-noise signature for this scanner.

Sources: [SANS ISC diary: Attackers Searching for SAP Netweaver Webshells (Johannes Ullrich, Nov 9)](https://isc.sans.edu/diary/33502)