Live › vulnerability › CVE-2020-6287
Go to dashboardSAP NetWeaver Application Server Java has a missing authentication check on a critical function, so anyone who can reach the server can run configuration tasks without logging in. An attacker can use it to create administrative users, which is the basis of the 'Recon' or 'Bizarre' SAP NetWeaver takeover campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SAP NetWeaver | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Apply the SAP security note for CVE-2020-6287 per vendor instructions, as CISA requires.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
This page as .md · .json · in your agent: get_signal("CVE-2020-6287")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.