CVE-2020-6287 (SAP NetWeaver Missing Authentication for Critical Function)

What this vulnerability means in SAP NetWeaver

This CVE is a missing-authentication flaw in a critical SAP NetWeaver function, which means the product exposed privileged capability without proving who was calling it. In practice, that turns a management interface into an entry point for unauthorised configuration changes and account creation.

The danger is not just that an attacker can reach the function, but that the function itself can change trust boundaries. Once unauthenticated access exists on a platform that supports business systems, the attacker may be able to pivot from simple access to durable control over the environment.

Why missing authentication is especially dangerous here

A missing-authentication condition is high impact whenever the affected function can alter configuration or create administrators. Those actions bypass the usual separation between ordinary users and privileged operators, so the weakness can collapse both access control and administrative oversight in one step.

For SAP NetWeaver, that matters because application server administration often sits close to the systems that carry sensitive business data and identity-integrated workflows. A flaw at this layer can therefore create enterprise-wide exposure, not just a local application issue.

When a vulnerability is in CISA’s KEV catalogue, it has already moved from theoretical weakness to known exploitation. Readers should treat the issue as active exposure and rely on the vendor advisory plus the CVE Program and the NIST National Vulnerability Database for canonical record details, then use the vendor’s remediation guidance for exact version handling.

How organisations assess exposure and reduce blast radius

Exposure checks should start with a complete inventory of SAP NetWeaver instances, especially internet-facing systems, management endpoints, and any environments where the Java application server is reachable from untrusted networks. If an exposed system can be queried without authentication, the practical risk is much higher than for a segmented internal deployment.

Compensating controls matter when patching is delayed. Restrict network access to administrative interfaces, remove public exposure, enforce strong segmentation around SAP administrative paths, and monitor for any unexpected configuration changes or new administrator accounts. The objective is to make unauthenticated reachability impossible even before the permanent fix is in place.

Detection, remediation, and post-compromise review

Because exploitation can create administrative users, incident review should not stop at patching the product. Organisations need to inspect for unauthorised configuration tasks, newly created accounts, privilege changes, suspicious logins, and any follow-on activity that used the created access to persist or move laterally.

Remediation should include removing attacker-created accounts, resetting credentials that may have been exposed through the compromise path, and reviewing adjacent systems that trusted the SAP environment. If the platform was used as a control plane for other services, compromise review should extend to any sessions, service accounts, or integration credentials that could have been reached from it.

For exposure management and verification discipline, the Vulnerability Management Guide is useful for structuring asset scope, prioritisation, remediation verification, and exception handling around actively exploited CVEs.

Risk and Threat Considerations

This vulnerability is dangerous because it removes the authentication gate from a function that can create privileged access. That creates a direct path from external reachability to administrative control, which is exactly the kind of condition attackers look for when they want fast initial access and durable persistence.

Failure mechanism: An unauthenticated request reaches a sensitive administrative function, allowing the attacker to change configuration or create a new admin account without proving identity.

Impact: The attacker can gain privileged control, alter system settings, expand access, and potentially use the SAP environment as a foothold for broader enterprise compromise.

Practitioner Guidance

Why practitioners should care: Treat any KEV-listed authentication bypass on an enterprise application platform as an incident-ready condition, not a routine patch queue item. If the affected service is reachable from outside trusted administration networks, exposure is immediate and the response window is short.

What to watch for: Look for unexpected administrator creation, configuration changes outside change windows, abnormal access to management endpoints, and post-exploitation activity that suggests the attacker used the new privilege to persist.

Practitioner takeaway: Validate exposure first, contain network reachability second, and verify compromise third, because patching alone does not prove the system was not already used.

Related resources from NHI Mgmt Group

• CVE-2020-24363 (TP-link TL-WA855RE Missing Authentication for Critical Function)
• CVE-2025-32433 (Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function)
• CVE-2023-28461 (Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function)
• CVE-2023-27532 (Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function)