CVE-2020-6207VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-6207: SAP Solution Manager Missing Authentication for Critical Function Vulnerability

Affects SAP Solution ManagerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 98.1% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-6207 (opens in a new tab)

Description

CVE-2020-6207 is a vulnerability in SAP Solution Manager User Experience Monitoring where a critical function lacks proper authentication. This flaw allows attackers to fully compromise all SMDAgents connected to the Solution Manager. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information are provided in the available data.

Summary

The SAP Solution Manager User Experience Monitoring component suffers from a missing authentication for a critical function, identified as CVE-2020-6207. This security weakness enables attackers to gain complete control over all SMDAgents linked to the Solution Manager, potentially leading to extensive compromise within affected environments. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). It has been confirmed to be exploited in the wild. No vendor advisory or patch details are included in the provided information.

Impact

Successful exploitation results in the complete compromise of all SMDAgents connected to the SAP Solution Manager, which could lead to unauthorized access and control over monitoring agents and potentially broader system impact within the affected infrastructure.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Due to the lack of explicit patch or workaround information, organizations should monitor SAP's official security advisories for updates and apply any provided fixes promptly.

Weaknesses

CWE-306Missing Authentication for Critical Function (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:55:57 UTC

Weaknesses

References

Related threats