SANS Internet Storm Center reported November 9 honeypot requests for /irj/servlet_jsp/irj/root/ant.jsp, linking the probe to attempts to exploit SAP NetWeaver or locate existing webshells.
The diary links this scanning to older CVE-2025-31324. It does not establish a new vulnerability, successful compromise or victim count.
The reported source also requested paths associated with other products and several generic upload locations. That mixed list supports treating the requests as scanning evidence, rather than assuming every path identifies an installed component.
For defenders, the useful next step is to correlate matching requests with server responses and host evidence. A request for a suspicious filename warrants investigation; it does not, by itself, prove that the file exists or executed.
Image: AI-generated editorial illustration created for DaySec.
