Vulnerability record · CVE-2020-6287 · published 14 July 2020
CVE-2020-6287: SAP NetWeaver AS Java LM Configuration Wizard missing authentication
Sap · Netweaver Application Server Java
The SAP NetWeaver AS Java LM Configuration Wizard fails to perform an authentication check, allowing an unauthenticated attacker to execute configuration tasks on the Java system. Because those tasks include creating an administrative user, the flaw gives full control over confidentiality, integrity and availability of the affected system.
Description
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an administrative user, and therefore compromising Confidentiality, Integrity and Availability of the system, leading to Missing Authentication Check.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 10.0, unauthenticated network exploitation, CISA KEV listing and near-maximum EPSS probability make this an urgent patching priority.
What it is
The SAP NetWeaver AS Java LM Configuration Wizard fails to perform an authentication check, allowing an unauthenticated attacker to execute configuration tasks on the Java system. Because those tasks include creating an administrative user, the flaw gives full control over confidentiality, integrity and availability of the affected system.
Impact
An attacker can create an administrative account and run critical configuration actions, effectively taking over the SAP Java system. This compromises the confidentiality, integrity and availability of the platform and any data it processes.
Attack surface
Reachable over the network via the LM Configuration Wizard component with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any host that can reach the exposed service can attempt the attack.
Exploitation
CVE-2020-6287 is listed in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.94719 (99.854th percentile), indicating active exploitation and very high likelihood of attempted exploitation. Reference tags include third-party advisories and a US Government resource, but no ransomware campaign use is documented.
What to do
- Apply the SAP security note 2934135 update for NetWeaver AS Java versions 7.30, 7.31, 7.40 and 7.50 as directed by the vendor.
- If patching cannot be completed immediately, restrict network access to the LM Configuration Wizard service to trusted management hosts only.
- Monitor and alert on creation of new administrative users or unexpected configuration task execution on SAP Java systems.
- Verify that no unauthorized administrative accounts exist and remove any that are not accounted for.
- Review SAP Java system logs and configuration changes for signs of tampering following exposure.
Detection
- Hunt for HTTP requests to the LM Configuration Wizard endpoints from untrusted or unexpected source IPs.
- Alert on creation of new SAP Java administrative users or privilege changes outside approved change windows.
- Monitor SAP Java system logs for configuration task execution events that do not correlate with scheduled administrative activity.
- Correlate network telemetry for access to the affected service with subsequent authentication or account-creation events.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-6287 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "SAP NetWeaver Missing Authentication for Critical Function Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-6287 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-6287), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
