SAP Solution Manager Missing Authentication for Critical Function Vulnerability
SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
- Vendor
- SAP
- Product
- Solution Manager
- CVSS
- 9.8
- EPSS (exploit probability)
- 98.1%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Added to KEV
Is CVE-2020-6207 being exploited?
Yes. CISA added CVE-2020-6207 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 98.1% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
What to do
CISA required actionApply updates per vendor instructions.
US federal civilian agencies must remediate by (181 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Other SAP CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-58231 SAP Commerce Cloud Data Hub Adapter Unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-44761 SAP Commerce Cloud ships sample OAuth2 client with publicly documented credentialswrite-up | [ CRITICAL ] | 9.1 | 0.5% | — |
| CVE-2026-44747 SAP NetWeaver AS ABAP memory-corruption via logical errors in memory managementwrite-up | [ CRITICAL ] | 9.9 | 0.6% | — |
| CVE-2026-27690 SAP AppRouter HTTP request smuggling in Node.js middlewarewrite-up | [ CRITICAL ] | 9.1 | 0.7% | — |
| CVE-2025-42999 SAP NetWeaver Deserialization Vulnerabilityransomware use | [ CRITICAL ] | 9.1 | 12.7% | |
| CVE-2025-31324 SAP NetWeaver Unrestricted File Upload Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 99.5% | |
| CVE-2017-12637 SAP NetWeaver Directory Traversal Vulnerability | [ HIGH ] | 7.5 | 95.1% | |
| CVE-2019-0344 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 7.1% |