---
id: "CVE-2020-6287"
kind: "vulnerability"
aliases: ["CVE-2020-6287"]
title: "SAP NetWeaver: SAP NetWeaver Missing Authentication for Critical Function Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.94719
exploited: true
status: "open"
category: "vendor"
products: [{"name": "SAP NetWeaver", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "netweaver", "sap", "vendor"]
not_affected_if: ["abap-only-stack"]
published_at: "2020-07-14T13:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-6287", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-6287", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6287", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# SAP NetWeaver: SAP NetWeaver Missing Authentication for Critical Function Vulnerability

SAP NetWeaver Application Server Java has a missing authentication check on a critical function, so anyone who can reach the server can run configuration tasks without logging in. An attacker can use it to create administrative users, which is the basis of the 'Recon' or 'Bizarre' SAP NetWeaver takeover campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SAP NetWeaver affected ? fixed ?

## Fix

Apply the SAP security note for CVE-2020-6287 per vendor instructions, as CISA requires.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-6287
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-6287
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-6287

## From the sources

SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_