How do you patch or mitigate CVE-2020-6207 (SAP Solution Manager Missing Authentication for Critical Function)?

CISA’s required action for CVE-2020-6207 is to apply updates per vendor instructions. In practice, find every instance of SAP Solution Manager in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What this CVE response means operationally

CVE-2020-6207 is a patch-and-verify problem, not a tuning problem. You need to confirm where SAP Solution Manager exists, apply the vendor update or mitigation exactly as documented, and treat any unpatched instance as an exposed management surface until proven otherwise. For a vulnerability already tracked by CISA, the operational priority is to reduce exposure fast, then verify whether the issue was already used against you.

Because the direct answer already says attackers used the flaw in the wild, the question is not just whether the fix is available. The real question is whether your estate still contains a reachable instance that can be abused before the maintenance window closes. That makes exposure discovery, internet-facing scope review, and post-fix validation part of the same response, not separate tasks.

Use CISA Known Exploited Vulnerabilities Catalog and NIST National Vulnerability Database to anchor the remediation workflow to the authoritative record, then apply the vendor’s required action for the exact SAP build you operate.

How to reduce exposure if patching is delayed

If you cannot patch immediately, the fallback is to make the vulnerable function unreachable from untrusted networks and, where necessary, remove the product from service until you can remediate. For an administrative platform like SAP Solution Manager, “temporary compensation” should mean shrinking access paths, not assuming the absence of public exploitation means the asset is safe. An exposed management interface with a known KEV entry should be treated as a high-priority containment issue.

Zero-Day and Exploited Vulnerabilities Guide is useful here because the response pattern is the same one used for actively exploited issues: prioritise emergency mitigation, not routine backlog handling. If the service must remain up, restrict who can reach it, document the exception, and keep the remediation owner aligned to a short deadline.

For prioritisation, the KEV catalogue tells you the vulnerability has crossed from theoretical exposure into a confirmed exploitation concern. That should move the issue ahead of ordinary patch queues and ahead of less urgent platform work.

What to check after remediation

After applying the update or mitigation, review logs and surrounding telemetry for evidence of earlier abuse. With a missing-authentication flaw, the main concern is not only direct service access, but also whether the attacker used that access to enumerate configuration, harvest data, or stage follow-on activity before the fix landed. If you see suspicious administrative actions, unexpected requests, new users, unusual job execution, or evidence of lateral movement, treat the instance as potentially compromised rather than merely vulnerable.

CISA cyber threat advisories provide the broader incident-response context for exploited flaws, while Vulnerability Management Guide is the practical model for verifying scope, tracking exceptions, and confirming that remediation actually closed the exposure. In other words, patching is complete only when you have both applied the fix and checked for signs that the flaw was already leveraged.

Risk and Threat Considerations

Missing authentication for a critical function creates a direct path from exposure to unauthorized administrative action. If the product is internet reachable, the attacker does not need a valid account first, which means standard access controls may never come into play before the abuse begins. That is why these flaws often move quickly from disclosure into active exploitation.

Failure mechanism: The vulnerable function can be reached without the authentication step the system was supposed to enforce, so an external actor may invoke privileged operations, inspect sensitive data, or change system state.

Impact: The result can include configuration tampering, unauthorized access, data exposure, and a launch point for further compromise inside the environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This CVE response depends on finding, prioritizing and remediating an exploited vulnerability.
Recommendation — Prioritise and remediate the KEV-listed flaw, then verify exposure is closed.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The answer centers on locating affected instances and validating remediation after exploitation.
	SI-2 — Flaw Remediation	The core action is applying vendor remediation for a known exploited software flaw.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-patch log review for earlier exploitation is explicitly part of the response.
Recommendation — Scan for affected instances, track remediation, and verify exposure is removed. Apply the vendor update or mitigation and document closure of the flaw. Review logs for signs of abuse before and during remediation.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	The subject is operational handling of a publicly exploited technical vulnerability.
Recommendation — Treat the flaw as a managed vulnerability with tracked remediation and exception handling.

Practitioner Guidance

What to prioritise: Identify every SAP Solution Manager instance first, then decide whether each one can be patched promptly or must be isolated immediately. If it is externally reachable, handle it as a containment issue until remediation is verified.

What to verify: Confirm that the vendor security update or documented mitigation was applied to the exact deployed instance, not just to a similar environment. Then validate that the service is no longer reachable from networks that should not need it.

Practitioner takeaway: For an exploited authentication-bypass flaw, the safe sequence is exposure discovery, immediate containment, vendor-directed remediation, and compromise review, because patching without validation leaves both the vulnerability and the attack trace unresolved.