CVE-2020-6287VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-6287: SAP NetWeaver Missing Authentication for Critical Function Vulnerability

Affects SAP NetWeaverSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 94.7% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-6287 (opens in a new tab)

Description

CVE-2020-6287 is a vulnerability in SAP NetWeaver Application Server Java Platforms where missing authentication for a critical function allows unauthenticated attackers to execute configuration tasks and create administrative users. This flaw enables unauthorized access to sensitive administrative capabilities without requiring valid credentials.

Summary

The vulnerability identified as CVE-2020-6287 affects SAP NetWeaver Application Server Java Platforms. It involves missing authentication controls on critical functions, permitting unauthenticated users to perform configuration changes and create administrative user accounts. This lack of authentication on sensitive operations can lead to unauthorized system control. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the source data.

Impact

Successful exploitation allows unauthenticated attackers to execute configuration tasks and create administrative users on SAP NetWeaver Application Server Java Platforms. This can lead to full system compromise, unauthorized administrative access, and potential disruption or manipulation of the affected system.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to SAP NetWeaver administrative interfaces and monitor for suspicious activity related to configuration changes or new administrative accounts.

Weaknesses

CWE-306Missing Authentication for Critical Function (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:55:59 UTC

Weaknesses

References

Related threats