Join our Newsletter — 33% off our NHI Course

CVE-2020-6207 (SAP Solution Manager Missing Authentication for Critical Function)

CVE-2020-6207 is a missing authentication for critical function vulnerability in SAP Solution Manager. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.

What this vulnerability means for SAP Solution Manager

Missing authentication for a critical function means the product exposes a sensitive action path without properly confirming the caller’s identity. In a system that supports enterprise operations and administration, that design flaw can let an unauthenticated user reach functionality that should have been restricted to trusted operators.

The practical risk is not just unauthorized access in the abstract, but misuse of privileged product capabilities that were never meant to be reachable from an untrusted session. For vulnerability tracking and patch prioritisation, use the CVE Program record and the NIST National Vulnerability Database entry alongside the vendor advisory for version and remediation details.

Why this class of flaw is dangerous

Authentication failures around critical functions are especially serious because they collapse the first trust boundary in the application. If an attacker can invoke an administrative or operational function without authenticating, the usual protections around role checks, approvals, and audit expectations may never come into play.

That makes the vulnerability attractive for initial access, unauthorized changes, and follow-on abuse. A product like SAP Solution Manager is often positioned near sensitive enterprise administration workflows, so one exposed function can become a stepping stone to broader operational compromise.

How organisations should assess exposure and limit impact

Exposure review starts with confirming whether SAP Solution Manager is deployed, where it is reachable, and whether the affected instance is internet-facing or otherwise accessible from untrusted networks. Organisations should compare asset inventory data with vendor guidance and the KEV listing, then treat any matching instance as a priority remediation target.

Where patching or mitigation is delayed, reduce the reachable surface around the affected function, tighten network access, and monitor for unexpected requests to the vulnerable path. Pair that with current vendor communications and the KEV catalogue so the response is anchored to authoritative remediation guidance rather than informal reports.

Detection, compromise review, and identity impact

Because this issue has been used in real attacks, defenders should look beyond patching and review whether the vulnerable function was exercised before remediation. That review should include logs, unusual administrative activity, and any downstream changes made through the affected product.

If exploitation is suspected, the identity impact may extend beyond the application itself. Review and rotate any credentials, service accounts, tokens, or sessions that could have been exposed or used through the compromised management path, especially where the product integrates with broader enterprise systems.

Risk and Threat Considerations

This flaw matters because an authentication bypass on a critical function can turn a management product into an entry point. Once an attacker can reach trusted functionality without proving identity, the likely outcomes are unauthorized actions, configuration tampering, or use of the product as a launch point for deeper compromise.

Failure mechanism: The application accepts a request to a high-value function without enforcing the authentication gate that should protect it, so the attacker can invoke trusted behavior directly.

Impact: The result can include unauthorized access, operational disruption, abuse of administrative capability, and faster progression into surrounding enterprise systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST SP 800-53 Rev 5 IA-2 — Identification and Authentication (Organizational Users) Directly addresses verifying users before privileged functions are reached.
IA-5 — Authenticator Management Supports rotation and protection of credentials that may be exposed during exploitation.
Recommendation — Enforce authenticated access before allowing high-value administrative actions. Rotate exposed authenticators and review their lifecycle after suspected abuse.
CIS Controls v8 CIS-5 — Account Management Matches the need to control and review accounts that a critical function could expose or abuse.
Recommendation — Review and remove unnecessary accounts and access paths tied to the affected system.
NIST CSF 2.0 PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited for authorized entities only Fits the authentication failure and the need to manage trust in access paths.
DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events Supports monitoring for exploitation attempts and post-patch compromise review.
Recommendation — Verify, audit, and revoke access paths that no longer meet trust requirements. Monitor network activity for abuse of the affected function and follow-on anomalies.

Practitioner Guidance

Why practitioners should care: This is the kind of flaw that rewards fast inventory confirmation and disciplined remediation ownership, because the risky condition is present before any visible misuse occurs. Treat every deployed instance as potentially exposed until you have verified the vendor fix or mitigation state.

What to watch for: Watch for unexpected access to the vulnerable function, unusual administrative requests, and signs that the system was touched before remediation. If compromise is plausible, investigate adjacent credentials and sessions as part of the same review.