How do you patch or mitigate CVE-2020-6287 (SAP NetWeaver Missing Authentication for Critical Function)?

CISA’s required action for CVE-2020-6287 is to apply updates per vendor instructions. In practice, find every instance of SAP NetWeaver in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What patching CVE-2020-6287 should look like in practice

The first step is inventory, not patching. Confirm every SAP NetWeaver instance, then apply the vendor security update or mitigation exactly as documented. For this kind of missing-authentication flaw, partial rollout leaves an exposed edge behind, so patching must be treated as an estate-wide change, not a single-host fix.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog to verify the current required action and any operational constraints before you change production systems.

What to do if you cannot patch immediately

If the fix cannot be applied right away, reduce exposure aggressively. The safest temporary step is to remove internet exposure, then place compensating controls around the service so only trusted administrative paths remain. If you cannot reduce exposure to an acceptable level, taking the product out of service is better than leaving a known exploitable path open.

For teams that need a structured response process for actively exploited flaws, the Zero-Day and Exploited Vulnerabilities Guide is a useful companion because this class of issue demands speed, containment, and post-fix verification rather than routine change pacing.

How to check whether you were already hit

After remediation, assume the vulnerability may have been used before you closed it. Review web and application logs for unusual requests, unauthorised function calls, new accounts, unexpected configuration changes, or signs that an attacker pivoted further into the environment. The key question is not only whether the system is patched now, but whether the exposed period was used to establish persistence or steal data.

That is why Vulnerability Management Guide matters here, because remediation is incomplete until verification, exception handling, and follow-up hunting are part of the workflow.

Risk and Threat Considerations

This vulnerability is dangerous because missing authentication on a critical function can turn a reachable SAP NetWeaver instance into an unauthorised execution path. When the product is internet-facing, exploitation can move from simple reconnaissance to direct abuse very quickly, which is why exposure reduction matters almost as much as the patch itself.

Failure mechanism: An attacker reaches the vulnerable function without valid credentials, then uses that access to execute privileged actions, change state, or stage follow-on activity before defenders notice.

Impact: The result can be service compromise, unauthorised data access, lateral movement, or a broader incident if the SAP system has trust relationships with other internal services or business processes.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	SAP NetWeaver vulnerability patching requires timely flaw remediation.
	RA-5 — Vulnerability Monitoring and Scanning	Exposure confirmation and post-fix hunting depend on identifying affected systems and signs of exploitation.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-patch log review is needed to detect earlier exploitation attempts or success.
Recommendation — Track the vulnerability, apply vendor fixes, and verify remediation across the estate. Scan for vulnerable SAP NetWeaver instances and validate remediation with follow-up assessment. Review logs for suspicious access, abuse, or persistence after remediation.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	This is a technical vulnerability management problem requiring vendor-directed remediation and tracking.
Recommendation — Maintain a vulnerability process that drives vendor update adoption and exception handling.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	The issue calls for asset identification, prioritisation, patching, and verification for an actively exploited flaw.
Recommendation — Continuously identify, prioritize, and remediate exposed vulnerable SAP systems.

Practitioner Guidance

What to prioritise: Treat external exposure as the first containment problem. If the instance is reachable from the internet, reduce or remove that path before spending time on lower-value tuning or broad validation work.

What to verify: Confirm the vendor fix was actually applied to every live instance, not just the systems your asset inventory already knows about. In SAP environments, shadow instances and forgotten test systems are a common reason exposure survives the “patch” window.

Decision rule: If you cannot prove the system was isolated during the vulnerable period, assume potential compromise and widen your log review and credential review accordingly. If the system was exposed only briefly but was internet-facing, still hunt, because exploitation of known flaws is often opportunistic.

Practitioner takeaway: For KEV-listed flaws like this one, the mature response is patch plus exposure control plus compromise assessment, because any one of those alone leaves a real residual risk.