CVE-2020-6287: SAP NetWeaver Missing Authentication for Critical Function Vulnerability

CVE-2020-6287 is a missing-authentication flaw in SAP NetWeaver Application Server Java Platforms. An unauthenticated attacker can reach critical configuration functions and create administrative users. Because those actions grant high privilege inside the application stack, the issue matters for any organization running SAP NetWeaver Java components that are reachable from untrusted networks.

Public detail is limited to the CISA description and the CWE classification; exact affected releases, CVSS scores, and exploit mechanics must be confirmed against the vendor advisory.

How it works

The weakness is CWE-306: Missing Authentication for Critical Function. In this class of flaw, a sensitive operation is exposed without first verifying the caller’s identity or authorization. According to the CISA summary, the vulnerable SAP NetWeaver Application Server Java Platforms allow unauthenticated access to execute configuration tasks and to create administrative users.

An attacker who can reach the affected interface can therefore invoke those tasks directly. Successful abuse typically yields a new administrative account under the attacker’s control, after which the attacker can alter system configuration, deploy additional components, or move laterally inside the SAP landscape. No further exploit specifics are provided in the available facts; defenders should treat any unauthenticated call that results in user creation or configuration change as a potential indicator and validate behavior against the vendor advisory.

Am I affected? How to find it in your systems

SAP NetWeaver Application Server Java commonly underpins SAP business applications, portals, and integration scenarios. It is often deployed on dedicated application servers or as part of larger SAP landscapes, sometimes exposed through reverse proxies or load balancers.

• Inventory all hosts and instances running SAP NetWeaver Application Server Java. Use SAP landscape management tools, software inventory agents, or configuration-management databases to locate them.
• Compare installed component versions and support-package levels with the list published in the vendor advisory for CVE-2020-6287. Do not rely on generic version ranges; confirm exact matches.
• Identify whether the configuration or administration endpoints that perform user-creation and system-configuration tasks are reachable from networks outside the trusted SAP administrative zone.
• Review application and security logs for unexpected administrative-user creation events, configuration-task executions originating from unknown or unauthenticated sources, or sudden appearance of new high-privilege accounts. Correlate these with network logs showing access to the relevant SAP ports or URLs.

Any system that matches the vendor’s affected criteria and exposes the critical functions without authentication should be treated as vulnerable until patched or otherwise mitigated.

How to remediate

The primary remediation is to apply the updates supplied by SAP, following the instructions in the vendor advisory for CVE-2020-6287. CISA’s required action is simply “Apply updates per vendor instructions.”

• Schedule and test the vendor patches in a non-production environment that mirrors production SAP NetWeaver Java instances.
• Deploy the updates to production during an approved change window, verifying that the critical configuration functions now enforce authentication.
• After patching, re-inventory the landscape to confirm every affected instance has been updated.
• As hardening for this weakness class, ensure that administrative and configuration interfaces are bound only to trusted management networks, require strong authentication, and are covered by role-based access controls. Remove or disable any unnecessary configuration endpoints.

If you can't patch immediately

When immediate patching is not feasible, apply compensating controls that reduce exposure of the unauthenticated critical functions.

• Segment SAP NetWeaver Application Server Java hosts so that the relevant configuration and administration interfaces are reachable only from a tightly controlled jump-host or management VLAN.
• Place a web-application firewall or reverse-proxy rule in front of the affected endpoints to block unauthenticated requests that attempt configuration or user-creation operations; tune the rule set against the vendor’s description of the vulnerable functions.
• If the business process allows, temporarily disable or restrict the configuration tasks that can create administrative users until the patch is applied.
• Increase monitoring: alert on any creation of new administrative accounts, unexpected configuration changes, and access attempts to the previously unauthenticated endpoints. Retain logs for forensic review.
• Limit outbound connectivity from the SAP servers to reduce the chance of post-compromise data exfiltration or further tooling download.

These measures do not eliminate the vulnerability; they only lower the likelihood of successful exploitation until the vendor update can be installed.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to full administrative compromise of the SAP system and subsequent exposure of business data. Known ransomware use is not documented for this CVE. If you suspect compromise, follow your incident-response plan: isolate affected hosts, preserve logs, rotate credentials for any newly created or potentially stolen administrative accounts, and assess whether sensitive data left the environment. You can also run a free exposure scan of your email addresses against known breach data sets to determine whether associated credentials have appeared in prior incidents.