How do you patch or mitigate CVE-2020-6287 (SAP NetWeaver Missing Authentication for Critical Function)?

What patching CVE-2020-6287 should look like in practice

The first step is inventory, not patching. Confirm every SAP NetWeaver instance, then apply the vendor security update or mitigation exactly as documented. For this kind of missing-authentication flaw, partial rollout leaves an exposed edge behind, so patching must be treated as an estate-wide change, not a single-host fix.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog to verify the current required action and any operational constraints before you change production systems.

What to do if you cannot patch immediately

If the fix cannot be applied right away, reduce exposure aggressively. The safest temporary step is to remove internet exposure, then place compensating controls around the service so only trusted administrative paths remain. If you cannot reduce exposure to an acceptable level, taking the product out of service is better than leaving a known exploitable path open.

For teams that need a structured response process for actively exploited flaws, the Zero-Day and Exploited Vulnerabilities Guide is a useful companion because this class of issue demands speed, containment, and post-fix verification rather than routine change pacing.

How to check whether you were already hit

After remediation, assume the vulnerability may have been used before you closed it. Review web and application logs for unusual requests, unauthorised function calls, new accounts, unexpected configuration changes, or signs that an attacker pivoted further into the environment. The key question is not only whether the system is patched now, but whether the exposed period was used to establish persistence or steal data.

That is why Vulnerability Management Guide matters here, because remediation is incomplete until verification, exception handling, and follow-up hunting are part of the workflow.

Risk and Threat Considerations

This vulnerability is dangerous because missing authentication on a critical function can turn a reachable SAP NetWeaver instance into an unauthorised execution path. When the product is internet-facing, exploitation can move from simple reconnaissance to direct abuse very quickly, which is why exposure reduction matters almost as much as the patch itself.

Failure mechanism: An attacker reaches the vulnerable function without valid credentials, then uses that access to execute privileged actions, change state, or stage follow-on activity before defenders notice.

Impact: The result can be service compromise, unauthorised data access, lateral movement, or a broader incident if the SAP system has trust relationships with other internal services or business processes.

Practitioner Guidance

What to prioritise: Treat external exposure as the first containment problem. If the instance is reachable from the internet, reduce or remove that path before spending time on lower-value tuning or broad validation work.

What to verify: Confirm the vendor fix was actually applied to every live instance, not just the systems your asset inventory already knows about. In SAP environments, shadow instances and forgotten test systems are a common reason exposure survives the “patch” window.

Decision rule: If you cannot prove the system was isolated during the vulnerable period, assume potential compromise and widen your log review and credential review accordingly. If the system was exposed only briefly but was internet-facing, still hunt, because exploitation of known flaws is often opportunistic.

Practitioner takeaway: For KEV-listed flaws like this one, the mature response is patch plus exposure control plus compromise assessment, because any one of those alone leaves a real residual risk.

Related resources from NHI Mgmt Group

• How do you patch or mitigate CVE-2020-24363 (TP-link TL-WA855RE Missing Authentication for Critical Function)?
• CVE-2020-6287 (SAP NetWeaver Missing Authentication for Critical Function)
• How do you patch or mitigate CVE-2025-32433 (Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function)?
• How do you patch or mitigate CVE-2023-28461 (Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function)?