Vulnerability record · CVE-2020-7388 · published 22 July 2021
CVE-2020-7388: Sage X3 AdxDSrv.exe authentication bypass leads to SYSTEM RCE
Sage · Adxadmin
Sage X3's AdxDSrv.exe component accepts a client-side authentication request that can be edited to bypass credential validation, allowing unauthenticated remote command execution as SYSTEM. The flaw is critical because it grants full control of the server without any credentials, and the required installation path can be obtained by chaining CVE-2020-7387.
Description
Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by exploiting CVE-2020-7387. This issue was fixed in AdxAdmin 93.2.53, which ships with updates for on-premises versions of Sage X3 including Version 9 (components shipped with Syracuse 9.22.7.2 and later), Sage X3 HR & Payroll Version 9 (those components that ship with Syracuse 9.24.1.3), Version 11 (components shipped with Syracuse 11.25.2.6 and later), and Version 12 (components shipped with Syracuse 12.10.2.8 and later) of Sage X3. Other on-premises versions of Sage X3 are unsupported by the vendor.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-accessible RCE as SYSTEM with a CVSS of 9.8 and very high EPSS, though not in KEV.
What it is
Sage X3's AdxDSrv.exe component accepts a client-side authentication request that can be edited to bypass credential validation, allowing unauthenticated remote command execution as SYSTEM. The flaw is critical because it grants full control of the server without any credentials, and the required installation path can be obtained by chaining CVE-2020-7387.
Impact
An unauthenticated attacker can execute arbitrary commands with SYSTEM privileges on the Sage X3 server, leading to full host compromise and access to business and financial data.
Attack surface
Reachable over the network via the AdxDSrv.exe service; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation does require knowledge of the installation path, which the description says can be learned through CVE-2020-7387.
Exploitation
Not listed in CISA KEV, but EPSS is 0.69444 (99.3rd percentile), indicating high predicted exploitation activity, and a Rapid7 reference is tagged Exploit.
What to do
- Apply the vendor fix: AdxAdmin 93.2.53 or the corresponding Syracuse component updates (9.22.7.2+, 9.24.1.3, 11.25.2.6+, 12.10.2.8+).
- Upgrade or migrate off unsupported on-premises Sage X3 versions, which the vendor does not patch.
- Restrict network access to AdxDSrv.exe and related Sage X3 services to trusted hosts only.
- Patch CVE-2020-7387 as well, since it leaks the installation path needed to exploit this flaw.
Detection
- Monitor AdxDSrv.exe process creation and child processes for unexpected command execution or SYSTEM-level activity.
- Alert on anomalous authentication requests to Sage X3 services, including modified or malformed client-side auth fields.
- Review network logs for external connections to Sage X3 service ports from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-7388 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-7388), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
