CVE-2020-6207 SAP Solution Manager Missing Authentication for Critical Function

Exploited in the wild Critical 10.0 Published 10 Mar 2020 Updated 21 Oct 2025

Unauthenticated attackers can compromise all SMDAgents connected to SAP Solution Manager due to missing authentication checks.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-6207?

CVE-2020-6207 is a critical missing authorization vulnerability in SAP Solution Manager (User Experience Monitoring), published on 10 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.

Weakness: CWE-306

Which versions are affected by CVE-2020-6207?

It affects 1 product.

Products include Sap Solution Manager.

How do I fix CVE-2020-6207?

No fix has been published for CVE-2020-6207 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-6207 being exploited?

Yes. Attackers have exploited CVE-2020-6207 in the wild since at least 3 Nov 2021.

Public exploit code: 2 Metasploit modules, 1 Nuclei template and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-r9hh-cq9h-xf68.